Loading story…
watchTowr reported that attackers may be actively exploiting two unpatched remote-code-execution vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances. Citrix had not confirmed the claims or published CVE IDs, affected versions, indicators of compromise, technical details, or fixes, leaving the reports unverified but potentially severe because the appliances commonly serve as internet-facing application-delivery and VPN gateways.
Organizations should inventory NetScaler deployments, restrict or remove unnecessary external and management access, preserve authentication and administrative logs, and monitor exposed appliances for signs of compromise. Teams should be prepared to isolate internet-facing systems where residual risk is unacceptable and rapidly apply Citrix guidance when available; the reported flaws are separate from the vendor's August advisory for actively exploited authentication-bypass vulnerability CVE-2026-19490 and denial-of-service flaw CVE-2026-19489.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
watchTowr publicly warned that reports indicated multiple unpatched remote-code-execution vulnerabilities in Citrix NetScaler ADC and Gateway appliances. The reported flaws were allegedly identified during forensic investigations and exploited in real-world attacks, but Citrix had not confirmed them, assigned CVEs, or released fixes.
Organizations reportedly began shutting down or isolating some internet-exposed NetScaler appliances following the unconfirmed RCE zero-day reports and national-authority guidance.
NCSC-NL reportedly issued a pre-notification to organizations regarding two unpatched Citrix NetScaler ADC and Gateway vulnerabilities, assessing that each could independently permit unauthenticated remote code execution. One reported flaw allegedly enables direct in-memory shellcode execution; neither issue had a public CVE, patch, or confirmed indicators of compromise at the time described.
CISA added Citrix NetScaler authentication-bypass vulnerability CVE-2026-19490 to the Known Exploited Vulnerabilities catalog.
Singapore's Cyber Security Agency warned that exploitation attempts targeting the NetScaler authentication-bypass vulnerability CVE-2026-19490 had been observed.
Citrix published a bulletin covering CVE-2026-19490, a critical authentication-bypass flaw under active exploitation, and CVE-2026-19489, a memory-overflow denial-of-service vulnerability. The bulletin provided fixed NetScaler ADC and Gateway versions and stated there was no workaround.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
thecybersecguru.com
Open sourcecybersecuritynews.com
Open sourcelabs.beazley.security
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citrix patched three critical vulnerabilities in on-premises **NetScaler ADC** and **NetScaler Gateway** appliances: `CVE-2025-7775`, `CVE-2025-7776`, and `CVE-2025-8424`. Citrix reported active exploitation of `CVE-2025-7775`, which can cause denial of service or enable arbitrary code execution; the other flaws can also enable code execution and may allow unauthorized access. The Dutch NCSC assessed the risk as **High/High**, citing widespread vulnerable deployments and the likelihood of large-scale exploitation. Citrix cloud services have been updated, while organizations operating affected on-premises appliances should urgently install Citrix fixes, apply vendor mitigations, monitor for suspicious activity, and use the NCSC's updated detection script to investigate potential compromise.
Aug 31, 2026
Citrix released security updates for **NetScaler ADC** and **NetScaler Gateway** to fix two critical vulnerabilities, **`CVE-2026-19490`** and **`CVE-2026-19489`**, affecting internet-facing application delivery and remote access infrastructure. `CVE-2026-19490` is an authentication bypass flaw with a **CVSS v4.0 score of 9.3** that can be exploited remotely by an unauthenticated attacker with low complexity and no user interaction, while `CVE-2026-19489` is a memory overflow issue that can lead to service disruption and other unpredictable behavior. Vendor guidance ties both issues to Citrix bulletin **`CTX696939`**. Affected versions include NetScaler ADC and Gateway **14.1 before 14.1-73.32** and **13.1 before 13.1-63.21**, with additional impact noted for **NetScaler ADC FIPS before 14.1-73.32 FIPS** and **13.1-37.277 FIPS/NDcPP**. Finnish authorities and Rapid7 said they were not aware of active exploitation at publication time, but both urged organizations to patch immediately because exposed Citrix edge devices are frequent high-value targets. Citrix also published version-specific remediation guidance and configuration checks to help customers determine whether their deployments meet the prerequisites for exploitation.
Aug 22, 2026
Dutch investigators found malicious webshells on Citrix NetScaler ADC and NetScaler Gateway appliances at multiple organizations following exploitation of critical 2025 NetScaler vulnerabilities. The affected flaws include `CVE-2025-5777`—an unauthenticated, remotely exploitable out-of-bounds read issue widely known as CitrixBleed 2—along with `CVE-2025-5349` and `CVE-2025-6543`; public proof-of-concept code for `CVE-2025-5777` increased the likelihood of broad exploitation. The Dutch NCSC urged organizations to immediately apply Citrix updates, investigate appliances for signs of compromise, and terminate active ICA, PCoIP, RDP, AAA, and load-balancing persistent sessions after patching. It also released forensic scripts and updated indicators of compromise for reviewing NetScaler coredumps and full appliance images, as researchers warned that exposed and unremediated devices may already have been compromised.
Aug 31, 2026