I wonder if this is an error
flightaware.com/live/flight/CIT9
Yes, it is a mistake.
So. How does this happen? what is the real N#?
For the same reason as the following:
flightaware.com/live/fleet/CGB (these are not flights operated by Air Cargo Belize)
flightaware.com/live/fleet/CFL (this is not a flight operated by Swedish Airline)
Additionally, I cannot find in the official documents of either the FAA or the ICAO any aircraft operator iwth the code CIT.
In other words, just because FlightAware says it is such-and-such operator does not mean it is.

So. How does this happen? what is the real N#?
No telling how it could have happened.
When it comes to the registration of an aircraft operating under a call sign, sometimes it is impossible to determine the N number while other times it’s very easy.
In the case of airlines, you cannot determine it directly. There are sites that can help for a few selected flights. (Use the search function above and look for “acars”). In the case of operators such as Netjets, it’s easy to determine the N number. In the vast majority of cases the N number will be the flight number with “QS” appended. For example, EJA161 is operated by N161QS.
Foreign registered (i.e. non-USA) do not have N numbers. The registration for these aircraft begin with other letters. The FAA publication "Contractions - available at faa.gov/air_traffic/publications/ - has a list of registration prefixes, airline call signs ("telephony"in FAA-speak), and aircraft codes, among other contractions.
Probably someone using the code by letter of agreement. We have the last user (now defunct I understand) to get that code from ICAO.
I’ve been flying on a charter that’s been showing up on FA as CIT2, CIT3, etc… The CIT9 used above may very well be the same charter company givne the geography, but I can assure you it’s NOT “city-vienna” as the operator.