CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added actively exploited Citrix NetScaler flaws CVE-2026-88771 and CVE-2026-88772 to the KEV catalog.
CISA added two Citrix NetScaler vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. CVE-2026-88771 is an improper input validation flaw, and CVE-2026-88772 is an improper restriction of operations within a memory buffer. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to rapidly remediate KEV entries on publicly exposed assets that grant total control after exploitation and to check for compromise before patching. CISA encourages all organizations to prioritize these vulnerabilities.
- CVE-2026-88771 is a Citrix NetScaler improper input validation flaw.
- CVE-2026-88772 is a NetScaler memory-bounds restriction vulnerability.
- CISA added both to KEV based on evidence of active exploitation.
- BOD 26-04 tells federal agencies to prioritize exposed high-risk KEV flaws.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-88771+1 related CVE | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
From the original article
1 min read at cisa.govCISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.