CISA orders feds to patch exploited Citrix flaws by Wednesday
CISA ordered federal agencies to patch two exploited critical Citrix NetScaler RCE flaws by September 30.
CISA added CVE-2026-88771 and CVE-2026-88772 to the Known Exploited Vulnerabilities catalog and ordered federal civilian agencies to secure Citrix NetScaler systems by September 30 under BOD 26-04. Citrix confirmed zero-day exploitation; both flaws allow unauthenticated remote code execution, the first on default ADC and Gateway configurations and the second when DTLS is enabled, which is default on VPN virtual servers. Shadowserver tracks more than 23,000 exposed NetScaler addresses, nearly 22,000 ADC and about 1,500 Gateway. Citrix warned its indicators of compromise may miss intrusions and advised preserving forensic evidence before patching.
- CISA added CVE-2026-88771 and CVE-2026-88772 to the KEV catalog.
- Both flaws allow unauthenticated remote code execution on NetScaler.
- FCEB agencies must remediate vulnerable appliances by September 30.
- Shadowserver tracks over 23,000 internet-exposed NetScaler addresses.
- Citrix says its indicators may miss compromises; preserve forensics first.
Vulnerabilities mentionedAll →
- CVE-2026-194909.37%Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gatewaypublished · Citrix NetScaler ADC and NetScaler Gateway KEV PoC
Full article628 words · extracted from bleepingcomputer.com · click to collapse
The Cybersecurity and Infrastructure Security Agency (CISA) has ordered U.S. government agencies over the weekend to secure their systems against attacks exploiting two critical Citrix NetScaler vulnerabilities.
Citrix released security updates to address the flaws (tracked as CVE-2026-88771 and CVE-2026-88772) days after national cybersecurity agencies, IT suppliers, and security teams began privately contacting Citrix customers and advising them to shut down their NetScaler appliances.
For instance, the Dutch National Cyber Security Center (NCSC-NL) reportedly warned organizations in the Netherlands about two critical NetScaler zero-days without CVE IDs that allowed threat actors to place shellcode directly into memory.
On Sunday, Citrix confirmed active exploitation of the two vulnerabilities in zero-day attacks and urged customers to patch their systems immediately.
Both flaws allow unauthenticated attackers to gain remote code execution on vulnerable NetScaler appliances. The first affects all NetScaler ADC and NetScaler Gateway deployments with default configurations, while the second requires DTLS to be enabled (Citrix noted that DTLS is toggled on by default on VPN virtual servers).
"Exploitation of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments has been observed. Citrix strongly urges affected customers to install the relevant updated versions as soon as possible," the company warned in a Sunday blog post that has a 'noindex' meta tag which tells search engines not to index the page.
"These vulnerabilities vary by deployment configuration and enabled features, and include issues that could allow remote code execution, denial of service, HTTP request smuggling, policy bypass, and TCP initial sequence number prediction under specific conditions."
Citrix has also shared what it describes as "generic Indicators of Compromise" through NetScaler Console to help security teams identify NetScaler deployments that may have already been compromised. However, it also warned that these IoCs "might be of limited forensic value and might fail to identify actual compromises" and advised customers "to retain the services of experienced forensic investigators."
Currently, threat watchdog Shadowserver tracks over 23,000 IP addresses with NetScaler fingerprints exposed on the Internet (including nearly 22,000 NetScaler ADC appliances and just over 1,500 Gateway instances). However, there is no information on how many are honeypots, have already been patched, or have vulnerable configurations.
On Sunday, CISA also added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog and ordered Federal Civilian Executive Branch (FCEB) agencies to secure all vulnerable Citrix appliances by September 30, as mandated by Binding Operational Directive (BOD) 26-04.
"Given the potential consequences of successful exploitation and the fact that malicious actors are exploiting at least some of these vulnerabilities, CISA urges users and administrators to review Citrix's advisories," the cybersecurity agency warned.
"If possible, users are encouraged to check for indication of compromise prior to patching. Citrix has made indicators of compromise available through NetScaler Console and published additional guidance. Should your organization suspect compromise, it is important to preserve forensic evidence prior to applying updates, as updates may result in loss of forensic visibility."
These two flaws are just the latest of several other Citrix vulnerabilities that attackers have exploited in the wild since the start of the year.
In March, Citrix urged admins to patch two other NetScaler flaws (CVE-2026-3055 and CVE-2026-4368) days before threat actors began abusing them in attacks. More recently, in early September, attackers began exploiting a NetScaler authentication bypass (CVE-2026-19490) patched in mid-August.
Since November 2021, CISA has flagged 26 actively exploited Citrix vulnerabilities, including six abused by ransomware gangs.
Build your security blueprint for AI-powered attacks
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.