Critical Alert: Unpatched Citrix NetScaler RCE and Oracle PeopleSoft Flaws Under Active Exploitation
Featured image: Photo by Miguel Á. Padriñán on Pexels.
In a rapidly evolving threat landscape, cybersecurity professionals are grappling with two distinct yet equally critical vulnerabilities currently under active exploitation. Organizations relying on Citrix NetScaler appliances and Oracle PeopleSoft applications are urged to take immediate action as threat actors leverage unpatched remote code execution (RCE) flaws and sophisticated bypass techniques to gain unauthorized access and deploy malicious payloads. The convergence of zero-day exploitation and renewed attacks on known vulnerabilities underscores a persistent challenge for defenders: the relentless pursuit by adversaries seeking to exploit any available weakness.
Unpatched Citrix NetScaler RCE: A Zero-Day Emergency
The cybersecurity community has been put on high alert following reports of two unpatched zero-day vulnerabilities affecting Citrix NetScaler ADC (Application Delivery Controller) and NetScaler Gateway appliances. These critical flaws, which allow for remote code execution, are reportedly under active exploitation in the wild [1]. The revelation, brought to light by security firm watchTowr on September 26, points to a severe and immediate risk for organizations utilizing these widely deployed network devices.
Remote Code Execution (RCE) vulnerabilities are among the most dangerous as they allow attackers to execute arbitrary code on a target system, potentially leading to full system compromise, data exfiltration, or the deployment of further malicious software. The fact that these are zero-day vulnerabilities means there is no official patch available from Citrix at the time of discovery and active exploitation [1]. This places administrators in an incredibly difficult position, forcing them to consider drastic measures to protect their networks.
The lack of an immediate fix has prompted some administrators to take their affected NetScaler appliances offline entirely rather than wait for a patch to become available [1]. This drastic step highlights the severity of the threat and the potential for widespread damage if these vulnerabilities are successfully exploited. NetScaler ADC and Gateway devices are often deployed at the network perimeter, handling critical functions like load balancing, VPN access, and application delivery. A compromise of these systems could provide attackers with a direct gateway into an organization’s internal network, bypassing traditional security controls and posing an existential threat to data integrity and operational continuity.
Organizations must treat this situation with the utmost urgency. Without a vendor-supplied patch, defensive strategies must focus on detection, containment, and risk mitigation. This includes meticulous monitoring for any unusual activity originating from or targeting NetScaler devices, implementing strict network segmentation, and preparing for rapid incident response. The ongoing active exploitation indicates that threat actors are actively scanning for and attempting to compromise vulnerable systems, making swift action paramount to prevent potential breaches.
Oracle PeopleSoft Under Siege: A Resurgent Threat with WAF Bypasses
Parallel to the Citrix emergency, Google has issued warnings regarding renewed mass exploitation of a known security vulnerability in Oracle PeopleSoft. This campaign is targeting multiple sectors globally and involves the weaponization of CVE-2026-35273, a critical security flaw with a CVSS score of 9.8 [2]. This vulnerability could result in unauthenticated remote code execution, allowing
Sources
- [1] Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation (feeds.feedburner.com)
- [2] Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells (feeds.feedburner.com)
- [3] ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks (www.bleepingcomputer.com)
StealthAnon is a news and analysis site covering cybersecurity, privacy, web analytics, anonymity, and tech tools.
