Back Ground.News

Citrix NetScaler 0-Day RCE Vulnerabilities Actively Exploited in Attacks

Ground.News • September 27, 2026

Security researcher Kevin Beaumont and a threat intelligence company are admonishing: New exploits are actively exploited. Official information is missing.

Vulnerability Found in Citrix Systems Used by Banks and Industries

Science and Heitech: Two new vulnerabilities have been reported online that are already being exploited worldwide and can allow remote code execution on Citrix equipment.

Citrix NetScaler 0-Day RCE Vulnerabilities Actively Exploited in Attacks

Citrix NetScaler administrators are confronting reports of two undisclosed remote code execution vulnerabilities allegedly exploited in real-world attacks. watchTowr said the flaws are unpatched zero-days, were identified during forensic investigations, and that Citrix communications and fixes are expected early week. However, Citrix had not published technical details, CVE identifiers, affected builds, indicators of compromise, […]

There is no tracked Bias information for the sources covering this story.

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Zero-Day Vulnerabilities in Citrix NetScaler Under Active Exploitation On September 26, 2026, security firm watchTowr reported two unpatched zero-day vulnerabilities in Citrix NetScaler ADC and Gateway appliances, allowing remote code execution (RCE) and actively exploited in the wild. Citrix has confirmed the existence of these vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, with severity scores of 9.5. The vulnerabilities were discovered during forensic investigations, indicating they were exploited before any patch was available. Administrators were advised to shut down their NetScaler appliances as a precaution. Citrix has since released a security bulletin detailing these flaws and provided patches on September 27, 2026. The vulnerabilities affect all NetScaler ADC and Gateway deployments, including those with default configurations. Organizations using these systems are urged to apply the updates immediately to mitigate the risk of exploitation. 100 sources 81

Citrix NetScaler 0-Day RCE Vulnerabilities Actively Exploited in Attacks

The full story

Extracted Entities

Attack Types (1)

Platforms (1)