Citrix NetScaler’s difficult year is getting harder. Separately from the patched SAML denial-of-service flaw tracked as CVE-2026-88779, security firm watchTowr says it uncovered two additional, previously undisclosed remote-code-execution vulnerabilities in NetScaler appliances while conducting forensic investigations — and that both appear to have already been exploited in real-world attacks.

What watchTowr Is Reporting

According to watchTowr, the two flaws surfaced during incident-response engagements rather than through routine security research, which is itself a signal worth taking seriously: forensic investigators typically find this class of bug because they’re already looking at compromised systems, not because they went hunting for theoretical weaknesses. The firm describes both issues as capable of remote code execution, a far more serious outcome than the denial-of-service impact Citrix has confirmed for this week’s patched SAML bug.

As of publication, Citrix had not issued a security advisory covering these two flaws, had not assigned CVE identifiers, and had not confirmed affected build ranges, exploitation prerequisites, or available patches. That absence of vendor confirmation is an important caveat: watchTowr’s report should currently be treated as a credible warning from a respected research firm rather than a fully established, vendor-verified disclosure. Security teams should still act on it, but with the understanding that key technical details may still change once Citrix responds.

Why the Timing Is Concerning

These reports land in the same week Citrix pushed emergency patches for the SAML authentication zero-day, and shortly after administrators spent days dealing with NetScaler appliances rebooting unexpectedly following an earlier patch cycle. Taken together, the pattern suggests NetScaler has drawn sustained attention from multiple independent researchers and threat actors simultaneously — the kind of scrutiny that tends to surface additional bugs in the same codebase once one flaw opens the door to deeper analysis.

NetScaler’s track record over the past several years, including previous high-profile incidents such as CitrixBleed, has already established the platform as a recurring target for both opportunistic scanners and more capable adversaries, precisely because NetScaler appliances typically sit at the network edge handling VPN access, load balancing, and authentication for an entire organization. A remote-code-execution flaw in that position is about as high-value a target as exists in enterprise infrastructure.

What Remains Unknown

• Which NetScaler versions or configurations are affected
• Whether the two new flaws require authentication or any specific feature to be enabled
• Whether exploitation has been limited to narrow, targeted attacks or broader scanning activity
• When Citrix will issue an advisory, CVE numbers, or a patch

Until Citrix responds directly, organizations are left weighing a credible but not yet fully substantiated warning against the operational reality of running internet-facing infrastructure that has already been targeted repeatedly this year.

Recommended Steps for Security Teams

• Inventory every NetScaler ADC and Gateway instance across the organization, including any that may have been overlooked in prior patch cycles.
• Reduce public exposure of management interfaces wherever possible, and restrict administrative access to trusted networks only.
• Preserve logs and relevant forensic evidence now, rather than after a confirmed compromise — if these flaws are later confirmed, early evidence will be far more valuable than anything collected retroactively.
• Review authentication events, session activity, configuration changes, running processes, and outbound network traffic for anomalies consistent with the kind of access an RCE flaw would grant.
• Organizations unable to mitigate exposure quickly may need to consider temporarily isolating affected appliances under an approved business-continuity plan.
• Monitor Citrix’s official security bulletin channel closely, since authoritative guidance — including CVE numbers and patches — is still pending.

Secure Bulletin will continue following this story and will update coverage once Citrix issues an official advisory or confirms watchTowr’s findings.