CISA adds exploited Citrix NetScaler CVEs to KEV, FCEB deadline September 30
CISA adds exploited Citrix NetScaler CVEs to KEV, FCEB deadline September 30
CISA has added two actively exploited Citrix NetScaler zero-days (CVE-2026-88771 and CVE-2026-88772) to its Known Exploited Vulnerabilities catalog and ordered Federal Civilian Executive Branch agencies to patch by September 30. Both flaws allow unauthenticated remote code execution against NetScaler ADC and Gateway appliances.
Citrix confirmed active exploitation of two critical NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, and released security updates. Both vulnerabilities allow unauthenticated remote code execution on vulnerable NetScaler appliances.
- CVE-2026-88771: Affects all NetScaler ADC and NetScaler Gateway deployments with default configurations.
- CVE-2026-88772: Requires DTLS to be enabled. Citrix states DTLS is on by default on VPN virtual servers.
Citrix's advisory notes additional potential impacts under specific conditions: denial of service, HTTP request smuggling, policy bypass, and TCP initial sequence number prediction.
CISA added both CVEs to its KEV catalog on Sunday under Binding Operational Directive (BOD) 26-04. CERT-EU strongly advised EU institutions and bodies to run a compromise assessment on any internet-facing appliance running an affected build.
Federal Civilian Executive Branch (FCEB) agencies are under a mandatory patch deadline. Citrix urges all affected customers to patch immediately. Shadowserver tracks over 23,000 IP addresses with NetScaler fingerprints exposed on the internet (approximately 22,000 NetScaler ADC and just over 1,500 Gateway instances); the source notes there is no information on how many are honeypots, already patched, or have vulnerable configurations.
FCEB agencies must secure all vulnerable Citrix appliances by September 30 per BOD 26-04. CISA added both CVEs to the KEV catalog on Sunday, September 28. The source does not give a specific patch release date beyond stating Citrix released updates after national agencies began privately advising customers to shut down appliances.
- Applies to NetScaler ADC and NetScaler Gateway deployments.
- CVE-2026-88771 affects default configurations; no special feature enablement required.
- CVE-2026-88772 requires DTLS to be enabled (on by default on VPN virtual servers per Citrix).
- Citrix IoCs are available through NetScaler Console. The source does not specify licensing requirements for NetScaler Console access.
- The source does not specify which NetScaler software versions are affected or which patch versions remediate the flaws.
- Identify all NetScaler ADC and Gateway appliances in your environment, including internet-facing instances.
- Check whether DTLS is enabled on VPN virtual servers (relevant to CVE-2026-88772 exposure).
- If possible, check for indicators of compromise via NetScaler Console before applying patches. Citrix warns that patching may result in loss of forensic visibility.
- Preserve forensic evidence before patching if compromise is suspected, as advised by CISA.
- If compromise is suspected, consider retaining experienced forensic investigators per Citrix's guidance.
- Apply Citrix's security updates as soon as possible per Citrix and CISA guidance.
- FCEB agencies: confirm patching is complete by September 30 per BOD 26-04.
- Review Citrix's published advisory and compromise guidance directly. (Note: Citrix's advisory currently carries a 'noindex' meta tag; locate it through official Citrix support channels.)
- Review CISA's KEV catalog entry for both CVEs for any additional remediation details.
My read is that the sequence matters operationally: both CISA and Citrix explicitly state that patching before checking for compromise may destroy forensic evidence. This creates a genuine tension for teams under deadline pressure. The IoC caveat from Citrix, that its generic IoCs 'might be of limited forensic value and might fail to identify actual compromises', means a clean IoC check does not confirm a clean system. Teams should weigh that limitation before treating a negative result as confidence that no breach occurred.
I would treat the patch-before-IoC-check warning as operationally significant, not boilerplate. Establish a short, time-boxed compromise assessment window using NetScaler Console IoCs before patching, while still meeting any applicable deadline. For appliances where a compromise assessment is not feasible before the deadline, document the decision and the forensic trade-off. Check Citrix's support channels directly for the advisory and patched build numbers, as the source does not specify them and the advisory page is currently marked noindex.
The source is a BleepingComputer news article dated September 28, 2026; it covers the CISA KEV addition, the FCEB deadline, Citrix's confirmation of exploitation, and high-level vulnerability descriptions, but does not provide specific affected or patched build version numbers, detailed IoC content, or licensing requirements for NetScaler Console.