Aether AI on X: "Warnings of an actively exploited remote code execution zero-day in @citrix ...

Aether AI on X: "Warnings of an actively exploited remote code execution zero-day in @citrix NetScaler (ADC and Gateway) are increasingly reported across independent, unofficial channels - sysadmin communities, national CERT guidance relayed through IT suppliers (for example the Nationaal Cyber Security Centrum (NCSC-NL), and other security researchers online.

Some organisations are proactively taking their NetScalers offline. Citrix has not published an advisory and no CVE is assigned yet, so the details are unconfirmed and may change.

Aether AI already knew exactly where our clients potentially exposed assets where because had been running AI powered attack surface management for months prior.

For anyone else, here's what we recommend.

1. Treat this as an elevated watch, not a confirmed breach. Do not panic on unconfirmed information, but do prepare.

2. Confirm you are already patched for the recent confirmed NetScaler flaws on the CISA KEV list (CVE-2026-19490 and CVE-2026-19489, the SAML IdP issues). Those are separate from this developing report.

3. Be ready to patch the moment Citrix ships a fix. Current chatter points to early week.

4. Consider the interim hardening being discussed by the community: restrict access to a VPN or IP allowlist, disable DTLS, and monitor the crash-dump folder for signs of exploitation.

5. Taking a non-critical device offline until Citrix confirms is a valid business call.

6. Hunt for signs of compromise now: unexpected files or web shells, new or unfamiliar admin sessions, and unusual outbound connections."

Warnings of an actively exploited remote code execution zero-day in

NetScaler (ADC and Gateway) are increasingly reported across independent, unofficial channels - sysadmin communities, national CERT guidance relayed through IT suppliers (for example the Nationaal Cyber Security Centrum (NCSC-NL), and other security researchers online.

Some organisations are proactively taking their NetScalers offline. Citrix has not published an advisory and no CVE is assigned yet, so the details are unconfirmed and may change.

Aether AI already knew exactly where our clients potentially exposed assets where because had been running AI powered attack surface management for months prior.

For anyone else, here's what we recommend.

1. Treat this as an elevated watch, not a confirmed breach. Do not panic on unconfirmed information, but do prepare.

2. Confirm you are already patched for the recent confirmed NetScaler flaws on the CISA KEV list (CVE-2026-19490 and CVE-2026-19489, the SAML IdP issues). Those are separate from this developing report.

3. Be ready to patch the moment Citrix ships a fix. Current chatter points to early week.

4. Consider the interim hardening being discussed by the community: restrict access to a VPN or IP allowlist, disable DTLS, and monitor the crash-dump folder for signs of exploitation.

5. Taking a non-critical device offline until Citrix confirms is a valid business call.

6. Hunt for signs of compromise now: unexpected files or web shells, new or unfamiliar admin sessions, and unusual outbound connections.

Warnings of an actively exploited remote code execution zero-day in

NetScaler (ADC and Gateway) are increasingly reported across independent, unofficial channels - sysadmin communities, national CERT guidance relayed through IT suppliers (for example the Nationaal Cyber Security Centrum (NCSC-NL), and other security researchers online.

Some organisations are proactively taking their NetScalers offline. Citrix has not published an advisory and no CVE is assigned yet, so the details are unconfirmed and may change.

Aether AI already knew exactly where our clients potentially exposed assets where because had been running AI powered attack surface management for months prior.

For anyone else, here's what we recommend.

1. Treat this as an elevated watch, not a confirmed breach. Do not panic on unconfirmed information, but do prepare.

2. Confirm you are already patched for the recent confirmed NetScaler flaws on the CISA KEV list (CVE-2026-19490 and CVE-2026-19489, the SAML IdP issues). Those are separate from this developing report.

3. Be ready to patch the moment Citrix ships a fix. Current chatter points to early week.

4. Consider the interim hardening being discussed by the community: restrict access to a VPN or IP allowlist, disable DTLS, and monitor the crash-dump folder for signs of exploitation.

5. Taking a non-critical device offline until Citrix confirms is a valid business call.

6. Hunt for signs of compromise now: unexpected files or web shells, new or unfamiliar admin sessions, and unusual outbound connections.