CISA orders feds to patch exploited Citrix flaws by Wednesday
Source Bleeping Computer
Mentioned vulnerabilities
Rated Critical by Threat Radar from the Bleeping Computer text
Data as of 28 Sep 2026, 06:33 UTC
What to do
AI-suggested
Citrix has released security updates addressing CVE-2026-88771 and CVE-2026-88772 and strongly urges immediate installation of these patches. CISA has mandated U.S. federal agencies to patch all vulnerable Citrix appliances by September 30, 2026. Organizations should review Citrix advisories and apply updates promptly. Citrix provides generic indicators of compromise via the NetScaler Console, but these may have limited forensic value; retaining experienced forensic investigators is recommended if compromise is suspected. Preserving forensic evidence prior to patching is important to maintain visibility into potential intrusions.
Description
Two critical Citrix NetScaler vulnerabilities (CVE-2026-88771 and CVE-2026-88772) have been actively exploited in zero-day attacks. These flaws allow unauthenticated remote code execution on vulnerable NetScaler appliances, with one affecting all default configurations and the other requiring DTLS enabled. CISA has mandated U.S. federal agencies to patch these vulnerabilities by September 30, 2026. Citrix has released security updates and provided indicators of compromise, though these IoCs may have limited forensic value. The vulnerabilities also include potential denial of service, HTTP request smuggling, policy bypass, and TCP sequence number prediction under certain conditions. Over 23,000 NetScaler devices are exposed on the internet, increasing risk. Citrix and CISA strongly urge immediate patching and forensic investigation if compromise is suspected.