[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIISnFKL1SC5Yi78X7QqQREgZrXtx8kzzA6STB6XkaNI":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"d05317ac-ceb8-4f1b-9ecd-029206b14922","Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation","warning-two-unpatched-citrix-netscaler-rce-zero-days-under-active-exploitation-1e494c","Two new unpatched zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances that allow remote code execution are being actively exploited in the wild, security firm watchTowr said on September 26. Citrix has not confirmed the flaws or published a fix. Some administrators say they have taken appliances offline rather than wait for one to be available. NetScaler ADC and","Security firm watchTowr reported on September 26 that two unpatched zero-day vulnerabilities in Citrix NetScaler ADC and Gateway appliances are being actively exploited. These vulnerabilities allow for remote code execution. Citrix has not yet confirmed the flaws or released a fix, leading some administrators to take their appliances offline as a precautionary measure.","Two unpatched Citrix NetScaler RCE zero-days are actively exploited.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fwarning-two-unpatched-citrix-netscaler.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhrnnWi_EE_zogEngdPWZDYXQTXqcArqvXtXYDj7_yLDzfVamEw9Nx7taRyM1SQf8-78qtxnt3nhNzcn36WnzYwZvFDQNvglCilw0Ltb4NjVkjjC8GH2nOUTnxIBPvRn8JVPcXJaidmbU0A6z-1RiX_OKgcpkzvL6xV7aM_YpQj6XdYIfalQH3h6o3b7pQ\u002Fs1600\u002Fcitrix-zero-day.jpg","2026-09-27T07:47:57+00:00","2026-09-27T10:00:25.686326+00:00",9,[17,20,22,25,28],{"name":18,"type":19},"NetScaler ADC","product",{"name":21,"type":19},"NetScaler Gateway",{"name":23,"type":24},"Citrix","vendor",{"name":26,"type":27},"unknown","threat_actor",{"name":26,"type":29},"campaign","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,43],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[23,18,21],{"controls":51,"vendors":138},[52,81,109],{"slug":53,"name":54,"problem":55,"products":56},"patch-management","Automated patch management","Known holes get closed in days, not months.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":47,"name":82,"problem":83,"products":84},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"slug":110,"name":111,"problem":112,"products":113},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",[139,144],{"slug":140,"name":23,"logo_path":141,"roles":142},"citrix","\u002Fvendor-logos\u002Fcitrix.png",[143],"affected",{"slug":145,"name":146,"logo_path":147,"roles":148},"watchtowr","watchTowr","\u002Fvendor-logos\u002Fwatchtowr.png",[149],"reported_by",{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":166},"unpatched-citrix-netscaler-zero-days-actively-exploited-in-the-wild","Unpatched Citrix NetScaler Zero-Days Actively Exploited in the Wild","Two unpatched zero-day vulnerabilities in Citrix NetScaler ADC and Gateway are being actively exploited before any vendor fix is available, representing a classic zero-day crisis scenario where defenders are at an inherent disadvantage. The root cause is the absence of a timely vendor patch combined with insufficient compensating controls to protect internet-facing appliances. This matters significantly because NetScaler devices sit at the perimeter of enterprise networks, meaning successful remote code execution can grant attackers a privileged foothold for lateral movement, data exfiltration, or ransomware deployment. The fact that some administrators had to take appliances offline entirely highlights the operational cost of inadequate vulnerability management and emergency response planning.",[155,156,157,158,159,160,161,162,163,164,165],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST IR-6: Incident Reporting","NIST SI-2: Flaw Remediation","NIST SI-5: Security Alerts, Advisories, and Directives","NIST SC-7: Boundary Protection (Network Segmentation)","CISA Known Exploited Vulnerabilities (KEV) Catalog","ITIL Problem Management: Known Error and Workaround Documentation","ISO\u002FIEC 27001 Annex A.12.6: Management of Technical Vulnerabilities",{}]