CISA orders feds to patch exploited Citrix flaws by Wednesday

Citrix has confirmed that two newly disclosed NetScaler vulnerabilities, CVE-2026-88771 and CVE-2026-88772, are being actively exploited as zero-days, after national cybersecurity agencies and security vendors had already been quietly urging customers to take appliances offline. Both bugs let an attacker with no credentials achieve remote code execution: the first impacts any default NetScaler ADC or NetScaler Gateway setup, while the second requires DTLS enabled, which is the default state on VPN virtual servers. In response, CISA added both flaws to its Known Exploited Vulnerabilities catalog and, invoking Binding Operational Directive 26-04, instructed federal civilian agencies to remediate every affected Citrix device by September 30. Citrix has released indicators of compromise and urged admins to check for signs of a breach before applying patches, since updating may erase forensic traces, while Shadowserver counts roughly 23,000 internet-facing NetScaler devices still potentially at risk.