CISA orders agencies to patch two exploited critical Citrix NetScaler RCE flaws
The federal deadline has passed, but the exposure applies to any organisation running NetScaler at its perimeter. Applying the patch is not enough: exploitation was under way before fixes shipped, so security teams should assume possible compromise, review appliance logs and sessions, and rotate credentials that passed through affected gateways. Boards should ask whether edge appliances are covered by the same emergency patching and threat-hunting procedures as core systems.
What Happened
CISA added CVE-2026-88771 and CVE-2026-88772, both of which allow unauthenticated remote code execution on NetScaler appliances, to its Known Exploited Vulnerabilities catalog and ordered US federal civilian agencies to secure vulnerable Citrix appliances by 30 September. Citrix released fixes days after national cybersecurity agencies, IT suppliers and security teams began privately advising customers to shut down their appliances. Citrix has confirmed exploitation of unmitigated deployments.
Why It Matters
The federal deadline has passed, but the exposure applies to any organisation running NetScaler at its perimeter. Applying the patch is not enough: exploitation was under way before fixes shipped, so security teams should assume possible compromise, review appliance logs and sessions, and rotate credentials that passed through affected gateways. Boards should ask whether edge appliances are covered by the same emergency patching and threat-hunting procedures as core systems.
Sources
- BleepingComputer (opens in a new tab): CISA orders feds to patch exploited Citrix flaws by Wednesday (2026-09-28)
More From This Briefing
- Trump and leading AI chiefs sign voluntary White House accord on frontier model safety
- OpenAI launches Dots, always-on agents running on dedicated cloud computers
- NAIC president says US regulators weighing tougher capital rules for offshore life reinsurance
- AMD agrees to acquire Fei-Fei Li's World Labs in all-stock deal valued at about $8.2bn
This story is part of the Laurenceo Intelligence briefing for 1 October 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.