CISA orders federal agencies to patch exploited Citrix flaws by Wednesday

The US Cybersecurity and Infrastructure Security Agency (CISA) spent the weekend ordering federal agencies to close two critical flaws in Citrix NetScaler appliances. Tracked as CVE-2026-88771 and CVE-2026-88772, both bugs are already being used in live attacks.

Citrix shipped fixes only days after national cyber agencies, IT suppliers and security teams began quietly telling customers to shut their appliances down. The Dutch NCSC-NL reportedly warned organizations about two NetScaler zero-days — before they even had CVE IDs — that let attackers write shellcode straight into memory.

What the flaws allow

Both let an unauthenticated attacker run code remotely. The first affects all NetScaler ADC and Gateway deployments in their default configuration; the second needs DTLS enabled — which, Citrix notes, is on by default for VPN virtual servers. Depending on the setup, the bugs also open the door to denial of service, HTTP request smuggling, policy bypass and TCP initial sequence number prediction.

Citrix has published "generic" indicators of compromise through NetScaler Console, but candidly warned they "might be of limited forensic value" and could miss an actual breach, urging customers to hire experienced forensic investigators. Notably, the Sunday blog post carrying the warning was tagged noindex, telling search engines to leave it out of results.

Scale and deadline

Shadowserver counts more than 23,000 internet-exposed IP addresses fingerprinted as NetScaler — nearly 22,000 ADC appliances and just over 1,500 Gateway instances. How many are already patched, are honeypots, or remain vulnerable is unknown.

CISA added both flaws to its Known Exploited Vulnerabilities catalog and, under Binding Operational Directive 26-04, ordered civilian federal agencies to secure every affected appliance by September 30. It advised checking for signs of compromise before patching, since updates can wipe forensic evidence. CERT-EU similarly urged EU institutions to run a compromise assessment on any internet-facing appliance running an affected build.

This is hardly Citrix's first fire drill this year: attackers hit a different pair of NetScaler flaws in March, and in early September abused an authentication bypass patched back in mid-August. Since November 2021, CISA has flagged 26 actively exploited Citrix vulnerabilities, six of them used by ransomware gangs.

Source: Bleeping Computer