CISA Adds Citrix NetScaler Flaw to KEV as Attackers Exploit Critical Bug

En bref

• CVE-2026-88771 affects Citrix NetScaler ADC and NetScaler Gateway.
• Attackers are actively exploiting the flaw without authentication.
• CVSS score of 9.5 reflects a critical improper input validation issue.
• CISA added the vulnerability to its KEV catalog in September 2026.
• A second related flaw expands the global exposure.

Citrix's NetScaler ADC and NetScaler Gateway are at the center of a critical security event after threat actors began leveraging a pair of vulnerabilities, including CVE-2026-88771. The issue stems from inadequate validation of input, which allows an unauthenticated party to reach vulnerable code paths. With a CVSS rating of 9.5, the defect is severe enough to demand immediate attention.

On Sunday in September 2026, the U.S. Cybersecurity and Infrastructure Security Agency moved the flaw into its Known Exploited Vulnerabilities list. That designation signals confirmed in-the-wild abuse rather than a theoretical risk. The campaign appears global in scope, and the presence of two flaws means defenders cannot focus on a single patch alone.

Organizations using Citrix NetScaler ADC or NetScaler Gateway—especially those exposing management interfaces or authentication endpoints—are affected. Because exploitation does not require credentials, internet-facing instances are the most urgent priority. Government, education, healthcare, and private-sector networks all share the same exposure if these appliances are deployed.

The KEV addition gives U.S. federal agencies a deadline to remediate, but the warning extends to every sector. Attackers are already exploiting the flaws, so delay increases the chance of compromise. The combination of remote, unauthenticated access and a near-maximum severity score makes this one of the more dangerous Citrix-related incidents in recent memory.

IT teams should inventory all NetScaler ADC and Gateway deployments, apply Citrix's available mitigations or updates, and monitor for unusual authentication or command activity. Watch for further CISA guidance, additional CVE assignments for the second flaw, and signs that exploitation is spreading beyond initial targets.

À faire maintenant

1. Immediately inventory all internet-facing NetScaler ADC and NetScaler Gateway instances and identify those running vulnerable versions.
2. Apply Citrix's latest security patches or documented mitigations for CVE-2026-88771 and the related second flaw without waiting for the next maintenance window.
3. If patching is not possible, restrict management and authentication interfaces to trusted networks or disable unnecessary external exposure.
4. Review logs for unauthenticated access attempts, anomalous sessions, unexpected configuration changes, and signs of post-exploitation activity.
5. Enable enhanced monitoring and alerting for NetScaler appliances, including authentication failures and unusual outbound connections.
6. Follow CISA KEV remediation timelines and check for updated Citrix advisories or additional CVE identifiers.
7. Rotate credentials and secrets stored on or accessible through affected appliances if compromise is suspected.

Références CVE

• CVE-2026-88771

Source originale

The Hacker News