Dutch National Cyber Security Centre (Organization): news timeline & CVEs

U.S. CISA adds Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog

CISA added two actively exploited Citrix NetScaler zero-days to the KEV catalog.

CISA added CVE-2026-88771 and CVE-2026-88772, both CVSS 9.5, to the Known Exploited Vulnerabilities catalog after confirming active global exploitation of Citrix NetScaler ADC and Gateway. CVE-2026-88771 is unauthenticated remote code execution from improper input validation and affects default configurations. CVE-2026-88772 is a CWE-119 memory buffer overflow that can cause remote code execution or denial of service when DTLS is enabled, which is default on VPN virtual servers. Citrix fixed both in 14.1-73.37, 13.1-64.23, and corresponding FIPS builds; federal agencies must remediate by September 30, 2026.

Security Affairsupdated Sep 29, 21:30 UTC · 7h agofirst Sep 28, 08:55 UTC · 1d agoExploit / PoC in the wild 23 sources CVE-2026-88771 CVE-2026-88772 CVE-2026-19490+1 CVEs

Citrix Confirmed Two New NetScaler Flaws Exploited as Zero-Day

Citrix confirmed exploited NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 allow unauthenticated remote code execution.

Citrix confirmed that CVE-2026-88771 and CVE-2026-88772, both CVSS 9.5, were exploited as zero-days in NetScaler ADC and NetScaler Gateway before patches on September 27, 2026. CVE-2026-88771 is improper input validation that lets an unauthenticated attacker run arbitrary commands on every affected deployment. CVE-2026-88772 is a memory overflow enabling remote code execution or denial of service when DTLS is enabled, the default on Gateway VPN virtual servers. Fixes are in 14.1-73.37, 13.1-64.23, and later FIPS builds; August releases that fixed CVE-2026-19490 remain vulnerable, and these flaws are unrelated to CVE-2026-19489 and CVE-2026-19490.

Security Affairsupdated Sep 29, 21:30 UTC · 7h agofirst Sep 27, 17:29 UTC · 2d agoExploit / PoC in the wild 23 sources CVE-2026-88771

Check Point Fixes a New Actively Exploited Critical Security Flaw

Check Point issued emergency hotfixes for actively exploited critical path traversal CVE-2026-93616 in Security Management Server.

Check Point released emergency hotfixes (R82.20 Security Hotfix) for CVE-2026-93616, a critical unauthenticated path traversal flaw allowing attackers to upload and execute malicious scripts on Security Management Servers, and confirmed exploitation in the wild against a handful of customers. Affected products include Security Management Server, Multi-Domain Security Management, Log Server, Multi-Domain Log Server, and SmartEvent, with IOCs published in the advisory. The flaw follows two earlier critical Check Point issues: CVE-2026-16232 (actively exploited auth bypass) and the Dutch NCSC warning covering CVE-2026-85102 and CVE-2026-85103.

Security AffairsSep 22, 19:31 UTC · 7d agoExploit / PoC in the wildCVE-2026-93616 CVE-2026-85102 CVE-2026-85103+1 CVEs1

Dutch National Cyber Security Centre

Timeline3 articles

Related CVEsby mentions

Appears with

U.S. CISA adds Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog

Citrix Confirmed Two New NetScaler Flaws Exploited as Zero-Day

Check Point Fixes a New Actively Exploited Critical Security Flaw