CISA orders feds to patch exploited Citrix flaws by Wednesday
CISA ordered federal agencies to patch two exploited critical Citrix NetScaler RCE flaws by September 30.
CISA added CVE-2026-88771 and CVE-2026-88772 to the Known Exploited Vulnerabilities catalog and ordered federal civilian agencies to secure Citrix NetScaler systems by September 30 under BOD 26-04. Citrix confirmed zero-day exploitation; both flaws allow unauthenticated remote code execution, the first on default ADC and Gateway configurations and the second when DTLS is enabled, which is default on VPN virtual servers. Shadowserver tracks more than 23,000 exposed NetScaler addresses, nearly 22,000 ADC and about 1,500 Gateway. Citrix warned its indicators of compromise may miss intrusions and advised preserving forensic evidence before patching.
- CISA added CVE-2026-88771 and CVE-2026-88772 to the KEV catalog.
- Both flaws allow unauthenticated remote code execution on NetScaler.
- FCEB agencies must remediate vulnerable appliances by September 30.
- Shadowserver tracks over 23,000 internet-exposed NetScaler addresses.
- Citrix says its indicators may miss compromises; preserve forensics first.
- Vendors
- Citrix
- Organizations
- CISADutch National Cyber Security CenterShadowserver
- Countries
- United StatesNetherlands
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19490 | Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway | 9.3 | 33% | KEVPoC | KEV |
| CVE-2026-3055 | Out-of-Bounds Read in Citrix NetScaler ADC and Gateway When Used as SAML IDP | 9.3 | 91% | KEVPoC | KEV |
| CVE-2026-4368 | Race Condition in NetScaler ADC and NetScaler Gateway when appliance is configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server… | 7.7 | 4% | ||
CVE-2026-88771+1 related CVE | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
From the original article
3 min read at bleepingcomputer.com
The Cybersecurity and Infrastructure Security Agency (CISA) has ordered U. S. government agencies over the weekend to secure their systems against attacks exploiting two critical Citrix NetScaler vulnerabilities.
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.