Claims of two zero-day flaws discovered in Citrix NetScaler

Citrix NetScaler administrators are facing reports of two undisclosed remote code execution flaws allegedly exploited in real attacks, spotted by watchTowr during digital forensics investigations. Citrix has so far published no technical details, identifiers, compromise indicators or security notices, prompting some organizations to shut down internet-facing NetScaler devices, disrupting VPN access, application delivery and authentication services. The warning must be distinguished from the August 19 advisory, which covered the critical authentication bypass CVE-2026-19490 with a CVSS score of 9.3 and the memory overflow CVE-2026-19489 scored 8.8. Guidance calls for a full inventory of devices, restricting administrative access, preserving logs and forensic evidence, and isolating exposed systems when patching is not possible, while monitoring Citrix's official advisory channel.