Active Exploits Target Zero‑Day RCE Bugs in Citrix NetScaler

According to threat‑intelligence firm watchTowr, security teams have verified that two formerly undisclosed remote‑code‑execution flaws in Citrix NetScaler are currently being exploited in live attacks.

During forensic analysis of breached systems, the vulnerabilities—identified as unpatched zero‑days—came to light. watchTowr reported that analysts detected malicious payloads that used the bugs to obtain command‑level control of the appliance and, consequently, of the internal networks.

Thousands of enterprises, data centers and cloud providers rely on NetScaler appliances as application‑delivery controllers and load balancers. Positioned at the network edge, they represent a prized target for adversaries aiming to evade perimeter security.

In the absence of an official vendor patch, firms should apply interim safeguards, including limiting inbound traffic to management interfaces, enforcing robust authentication, and scrutinizing logs for atypical NetScaler behavior. Incident‑response groups ought also to examine network flows for exploitation indicators and be ready to quarantine compromised units.

Citrix has confirmed the findings and stated that a security advisory and patches are on the way. The revelation highlights the wider issue of zero‑day risks, leading experts to urge quicker vulnerability‑disclosure procedures and stronger segmentation of critical infrastructure.