Citix Discloses Third Actively Exploited NetScaler Zero-Day Vulnerability

Citix has confirmed a third zero-day flaw in its NetScaler platform is under active exploitation, following two similar disclosures earlier this week.

Threat Times Exposure DeskOctober 9, 20262 min read

Share LinkedIn Reddit

Illustration: A sleek black network appliance sits on a dark desk, its front panel glowing with three red status lights. — AI-generated illustration: Threat Times

Key points

Citix confirmed a third zero-day vulnerability in NetScaler is being actively exploited in the wild.
This disclosure follows two other actively exploited zero-days revealed by the vendor in less than seven days.
Security researchers assess the impact of this specific flaw as relatively low compared to the previous two vulnerabilities.

Citix has disclosed that a third zero-day vulnerability in its NetScaler application delivery controllers is currently being exploited by threat actors. This announcement marks the third such disclosure from the vendor in less than a week, continuing a rapid cycle of security updates for its infrastructure products.

According to CyberScoop, the vendor responded to this latest defect with greater speed and consistency than in previous incidents. While the frequency of the disclosures is notable, security researchers have characterized the impact of this specific vulnerability as relatively low when compared to the severity of the two prior zero-days disclosed earlier in the week. The rapid succession of these findings has drawn attention to the ongoing security challenges facing Citix’s NetScaler platform, which remains widely deployed in enterprise environments for traffic management and security services.

Context and Background

The current situation involves three distinct zero-day vulnerabilities identified within a single week. A zero-day vulnerability is a security flaw that is unknown to the software vendor or for which no patch has been issued at the time of discovery and exploitation. The fact that all three flaws are under active exploitation indicates that threat actors are actively scanning for and targeting vulnerable NetScaler instances.

CyberScoop reported that Citix’s response to this third defect was notably quicker and more consistent than its handling of the previous pair of zero-days. This improved response time may reflect lessons learned from the initial incidents or an enhanced monitoring process. However, the low-impact assessment by researchers suggests that while the vulnerability is real and being used, the potential damage or data exfiltration risk associated with this specific flaw is less severe than the earlier disclosures.

Who Is Affected

Organizations running Citix NetScaler application delivery controllers are the primary targets of this campaign. NetScaler devices are critical infrastructure components used for load balancing, web application firewalls, and secure remote access. Because these devices often sit at the edge of corporate networks, they are high-value targets for attackers seeking initial access to internal systems.

The widespread nature of NetScaler deployments means that a significant number of enterprises may be exposed. The active exploitation status confirms that the vulnerability is not theoretical; attackers are successfully leveraging it against live systems. Organizations that have not yet applied the necessary mitigations or updates for the previous two zero-days may also remain vulnerable to those higher-impact flaws, compounding the risk landscape.

What should you do?

Security teams should immediately verify the status of their NetScaler appliances against the latest vendor advisories. Given the active exploitation, it is critical to ensure that all systems are updated to the most recent secure version. Organizations should also monitor network logs for unusual traffic patterns originating from or directed to NetScaler devices, as this may indicate exploitation attempts.

What to do and how to stay safe: Citix

Inventory all Citix NetScaler devices and check their current software versions against the vendor’s latest security advisories to identify exposure.
Monitor network traffic and security logs for anomalous activity involving NetScaler appliances, such as unexpected connections or unusual authentication failures.
Restrict access to NetScaler management interfaces to trusted IP addresses only to reduce the attack surface until a fix is confirmed.
Review recent security patches and ensure that any previously disclosed zero-days for NetScaler have been addressed to prevent compounded risk.

Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.