Active Exploitation of Two Zero‑Day RCE Bugs in Citrix NetScaler Reported

According to threat‑intelligence firm watchTowr, security analysts have verified that two newly discovered remote‑code‑execution flaws in Citrix NetScaler are currently being leveraged in live attacks.

Identified as unpatched zero‑day bugs, the vulnerabilities surfaced while forensic teams examined breached systems. watchTowr reported that malicious payloads exploiting these flaws attained command‑level control of the NetScaler device and, consequently, access to the surrounding internal network.

Deployed as application‑delivery controllers and load balancers, NetScaler appliances support thousands of enterprises, data centers and cloud services. Sitting at the network perimeter, they represent a prized target for adversaries aiming to circumvent outer‑layer defenses.

In the absence of an official patch, firms should apply interim safeguards like limiting inbound connections to management interfaces, enforcing robust authentication, and scrutinizing logs for atypical NetScaler behavior. Incident‑response units are also urged to inspect network flows for exploitation indicators and be ready to quarantine compromised units.

Citrix has confirmed receipt of the findings and signaled that a security advisory together with patches will be released soon. This revelation highlights the wider issue of zero‑day risks, leading specialists to advocate for swifter vulnerability‑disclosure practices and tighter segmentation of essential infrastructure.