CISA adds two actively exploited critical Citrix NetScaler flaws to KEV; federal deadline 30 September
NetScaler appliances often serve as the front door for remote access. Unauthenticated exploitation of default configurations should therefore be treated as an emergency change, not held for the next maintenance window. Because exploitation is already active, patching alone is insufficient: teams should assume possible prior compromise, review appliance logs and sessions, and plan the downtime now rather than negotiating it after an incident.
What Happened
CISA added CVE-2026-88771 and CVE-2026-88772, both rated CVSS 9.5, to its Known Exploited Vulnerabilities catalog after reports and partner intelligence confirmed active global exploitation. One flaw allows unauthenticated remote code execution on NetScaler ADC and Gateway in default configurations; the other is a memory buffer overflow in DTLS-enabled VPN virtual servers that can enable remote code execution or denial of service. Citrix has released fixed versions, CISA noted that updates can require downtime, and US federal civilian agencies must remediate by 30 September 2026.
Why It Matters
NetScaler appliances often serve as the front door for remote access. Unauthenticated exploitation of default configurations should therefore be treated as an emergency change, not held for the next maintenance window. Because exploitation is already active, patching alone is insufficient: teams should assume possible prior compromise, review appliance logs and sessions, and plan the downtime now rather than negotiating it after an incident.
Sources
- CISA (opens in a new tab): CISA Adds Two Known Exploited Vulnerabilities to Catalog (2026-09-27)
- CISA (opens in a new tab): Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway (2026-09-27)
- Citrix (opens in a new tab): NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-88771 through CVE-2026-88778 (2026-09-27)
More From This Briefing
- Anthropic releases Claude Sonnet 5.5 at unchanged API prices, adding cyber safeguards to its mid-tier model
- New estimate puts US data centre and AI infrastructure investment at $10.3 trillion from 2025 to 2032
- CISA discontinues its weekly Vulnerability Bulletin as of 28 September in shift to risk-based prioritisation
- Actively exploited SharePoint flaw CVE-2026-65660 passes CISA's 28 September federal patch deadline
This story is part of the Laurenceo Intelligence briefing for 29 September 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.