Frequently asked questions about reported Citrix NetScaler zero-day vulnerabilities

There are reportedly two unpatched zero-day Citrix NetScaler vulnerabilities capable of enabling remote code execution that have been actively exploited in the wild, with no patches available at this time.Key takeawaysReports indicate that there are two critical zero-day vulnerabilities in Citrix NetScaler.The reports originate from a pre-notification sent out ahead of public disclosure, so there are currently no specific details about these flaws and no patches available.This post will be updated as new information becomes available.BackgroundTenable's Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding two reported zero-day vulnerabilities in Citrix NetScaler that sources say were actively exploited in the wild. The following FAQ is based on limited public information. This post will be updated with additional details once more information becomes public over the next week.FAQWhat is the source of the NetScaler vulnerabilities?On September 25, 2026, reports surfaced through a reddit post on r/Citrix regarding advice to shut down “Netscalers.” This included a report from a user that said this information came from the…

≈