CISA Adds Critical Citrix NetScaler Flaw (CVE-2026-88771) to KEV Catalog

En bref

• CVE-2026-88771 affects Citrix NetScaler and carries a CVSS score of 9.5.
• Exploitation requires no authentication and can lead to remote code execution.
• CISA added the flaw to its KEV catalog.
• Federal agencies must patch by the due date; all organizations should prioritize remediation.

CISA has incorporated a highest-severity security flaw impacting Citrix NetScaler into its Known Exploited Vulnerabilities list. The flaw, tracked as CVE-2026-88771, carries a CVSS score of 9.5. It arises from improper input validation and enables unauthenticated attackers to run arbitrary code remotely. The KEV listing means federal civilian agencies must remediate within a set deadline, but the risk extends to all organizations using the product.

Citrix NetScaler is widely deployed for application delivery, load balancing, and remote access. Government agencies, healthcare providers, and critical infrastructure operators are among the most likely targets. Because exploitation requires no credentials, any internet-facing instance could be at risk. The high CVSS reflects the potential for full system compromise, data theft, and lateral movement.

The addition to the KEV catalog signals that CISA considers the vulnerability a significant threat, possibly with evidence of active exploitation. Past flaws in similar remote-access products have been weaponized by ransomware crews and state-sponsored actors. The improper input validation likely affects the web management interface or a network-facing service, making rapid patching essential.

Organizations should not wait for a confirmed breach. Review Citrix advisories for patches and mitigations. If a patch is unavailable, restrict access to the management plane, enable multi-factor authentication, and monitor for anomalous behavior. Watch for updates from CISA and Citrix, and be prepared to conduct a compromise assessment if you cannot verify remediation.

À faire maintenant

1. Immediately inventory all Citrix NetScaler instances, including virtual appliances and cloud deployments, and determine which are internet-facing.
2. Apply the latest vendor patch or hotfix as soon as it is released; if unavailable, implement temporary mitigations per Citrix guidance.
3. Restrict management interfaces from public exposure and enforce network segmentation with strong access controls.
4. Enable detailed logging and monitor for signs of compromise, such as unexpected process creation, outbound connections, or new admin accounts.
5. Prioritize CISA KEV entries in your vulnerability management program and automate patch tracking for critical assets.
6. Conduct a compromise assessment if you cannot confirm patching, focusing on persistence mechanisms and lateral movement.
7. Report any suspected incidents to CISA or your local cyber center and share indicators with peer organizations.

Références CVE

• CVE-2026-88771

Source originale

Security Affairs