Towr says two unpatched NetScaler RCE flaws were exploited before fixes, while Citrix has yet to publish a bulletin or patch.
Citrix patched eight NetScaler flaws, including two zero-days attackers already exploit. CISA says both exploited bugs can enable remote code execution without passwords or user interaction.