Citrix NetScaler Zero-Day Exploited Globally
September 29, 2026 · LevelBlue SpiderLabs · Severity: CRITICAL
This article reports that Citrix NetScaler has two critical zero-day vulnerabilities under active global exploitation, with patches released on September 27 and inclusion in CISA's KEV list. The post confirms LevelBlue itself has had no impact, but emphasizes the need for immediate action by all users. 📌 **Analyst Note:** Zero-days in widely deployed network appliances like NetScaler are prime targets for attackers, so patching must be treated as an emergency. Organizations should also check for indicators of compromise, since these vulnerabilities were exploited before patches were available.
On Sept 27, Citrix released patches for two critical vulnerabilities being exploited in the wild. Based on current information, we confirm there has been no exposure or impact to LevelBlue or our clients. CISA has already added these vulnerabilities to the Known Exploited Vulnerabilities (KEV) list.
Key Takeaways
- Citrix released patches on September 27 for two critical vulnerabilities in NetScaler that are being actively exploited in the wild, according to the vendor and cybersecurity researchers.
- CISA has added these vulnerabilities to its Known Exploited Vulnerabilities catalog, signaling federal agencies must apply patches urgently and security teams should prioritize remediation.
- LevelBlue confirmed there has been no exposure or impact to itself or its clients, but the global exploitation of these flaws demands immediate patching and compromise assessment.