CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally
CISA says attackers are globally exploiting critical Citrix NetScaler flaws CVE-2026-88771 and CVE-2026-88772.
CISA added CVE-2026-88771 and CVE-2026-88772, both CVSS 9.5, to the Known Exploited Vulnerabilities catalog after confirming global exploitation against Citrix NetScaler ADC and Gateway. CVE-2026-88771 is improper input validation that allows unauthenticated command execution on all deployments; CVE-2026-88772 is a memory-buffer flaw enabling remote code execution or denial of service when DTLS is enabled, the default on VPN virtual servers. Fixes are in 14.1-73.37 and 13.1-64.23 and later, plus listed FIPS and NDcPP builds. Federal Civilian Executive Branch agencies must apply fixes by September 30, 2026.
- Both flaws are CVSS 9.5 and were added to CISA KEV.
- CVE-2026-88771 allows unauthenticated command execution on every deployment.
- CVE-2026-88772 can yield RCE or denial of service via DTLS.
- Patches are 14.1-73.37, 13.1-64.23, and listed FIPS and NDcPP builds.
- Federal civilian agencies must remediate by September 30, 2026.
- Vendors
- Citrix
- Products
- NetScaler ADCNetScaler Gateway
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-88771+1 related CVE | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
From the original article
2 min read at thehackernews.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) on Sunday added two critical Citrix NetScaler ADC and Gateway flaws to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.