U.S. CISA adds Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog
CISA added two actively exploited Citrix NetScaler zero-days to the KEV catalog.
CISA added CVE-2026-88771 and CVE-2026-88772, both CVSS 9.5, to the Known Exploited Vulnerabilities catalog after confirming active global exploitation of Citrix NetScaler ADC and Gateway. CVE-2026-88771 is unauthenticated remote code execution from improper input validation and affects default configurations. CVE-2026-88772 is a CWE-119 memory buffer overflow that can cause remote code execution or denial of service when DTLS is enabled, which is default on VPN virtual servers. Citrix fixed both in 14.1-73.37, 13.1-64.23, and corresponding FIPS builds; federal agencies must remediate by September 30, 2026.
- CVE-2026-88771 allows unauthenticated remote command execution on default NetScaler deployments.
- CVE-2026-88772 is a buffer overflow affecting DTLS, enabled by default on VPN vServers.
- Citrix confirmed both zero-days were exploited before patches shipped.
- Fixed releases include 14.1-73.37, 13.1-64.23, and matching FIPS builds.
- CISA orders federal agencies to remediate by September 30, 2026.
- Vendors
- Citrix
- Products
- NetScaler ADCNetScaler Gateway
- Organizations
- CISAwatchTowrDutch National Cyber Security Centre
- Countries
- United StatesNetherlands
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19489 | Unauthenticated Buffer Overflow in Citrix NetScaler ADC and NetScaler Gateway | 8.8 | <1% | ||
| CVE-2026-19490 | Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway | 9.3 | 33% | KEVPoC | KEV |
CVE-2026-88771+1 related CVE | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
From the original article
3 min read at securityaffairs.com
U. S. Cybersecurity and Infrastructure Security Agency (CISA) adds Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.