CISA Flags Two Citrix NetScaler Flaws Under Active Attack, Orders Federal Fixes

Key points

• CISA's KEV Catalog now includes two NetScaler vulnerabilities, CVE-2026-88771 and CVE-2026-88772.
• The flaws are being actively exploited, posing serious risk including full control of affected systems.
• Federal civilian agencies must remediate rapidly under binding directive; all NetScaler users should treat as urgent.

As of September 27, 2026, the Known Exploited Vulnerabilities (KEV) Catalog maintained by CISA includes two Citrix NetScaler vulnerabilities that were added. The flaws, tracked as CVE-2026-88771 and CVE-2026-88772, are already being leveraged by malicious actors, according to the federal alert. This action compels U.S. Agencies of the Federal Civilian Executive Branch (FCEB) should treat remediation as a top priority and move it forward faster.

Citrix NetScaler is widely deployed as an application delivery controller and secure remote access gateway across government and private-sector networks. The two vulnerabilities carry significant risk: successful exploitation can grant an attacker total control over the target asset, enabling further lateral movement, data theft, or service disruption. Because NetScaler often sits at the network edge and handles authentication, compromise can be especially damaging.

While the KEV mandate specifically applies to FCEB agencies, the broader threat extends to any organization running affected NetScaler instances. State, local, tribal, and territorial governments—including K-12 school districts—frequently rely on the same technology for remote access and web application delivery. Attackers do not discriminate by sector, and edge devices remain a favorite initial access vector.

The inclusion in KEV signals that this is not a theoretical flaw. Active exploitation means real-world attacks are underway, and the window for patching without incident is closing. Federal agencies face strict deadlines; other entities should treat the vulnerabilities with equal urgency, even without a formal directive. Rapid remediation is essential to prevent total asset takeover.

What to watch: further technical details from CISA or Citrix about exploitation in the wild, any proof-of-concept code that could broaden attacks, and updates to the KEV due dates. Administrators should monitor vendor advisories and verify their NetScaler versions immediately.

What to do now

1. Inventory all NetScaler instances and identify versions affected by CVE-2026-88771 and CVE-2026-88772.
2. Apply Citrix's latest security patches immediately; if patching is delayed, isolate appliances or restrict management access.
3. Enable and review logs for signs of exploitation, particularly unusual authentication or outbound connections.
4. Reset credentials and rotate secrets for any NetScaler device that may have been exposed.
5. Block known malicious IPs and apply CISA's mitigations; consider temporary shutdown of internet-facing management interfaces.
6. For FCEB agencies, document remediation in accordance with KEV deadlines; others should treat as high priority.
7. Test patches in a staging environment only if it does not delay emergency deployment; otherwise patch production first.

CVE references

• CVE-2026-88771
• CVE-2026-88772

Original source

CISA Advisories