Skip to content
OriginalSign in

CISACISA

CISA Flags Actively Exploited Citrix NetScaler Flaws for Urgent Action

Part of the CVE-2026-88771 story · since 27 Sep

Quiet for 2 weekslast report 27 Oct29 articles13 outlets
27 Sep · SecurityOnline first22 Oct30 OctNowThis article3rd of 29
  • Sun 27 Sep, 18:30 UTC. SecurityOnline, first report. Citrix NetScaler Zero Days Exploited to Attack VPN Appliances. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 18:30 UTC. Security Affairs, its first report on the story. Citrix NetScaler Zero Days Exploited Against Unpatched Systems. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 20:47 UTC. CISA, its first report on the story. CISA Flags Actively Exploited Citrix NetScaler Flaws for Urgent Action. Cites a CVE in CISA KEV. This article, 3rd of 29.
  • Sun 27 Sep, 20:47 UTC. CISA. CISA Warns Attackers Are Exploiting Critical Citrix NetScaler Zero-Days. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 23:02 UTC. CISA. CISA Warns NetScaler Flaw Is Being Exploited for Command Execution. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:00 UTC. SecurityWeek, its first report on the story. Citrix Patches NetScaler Zero Days Exploited in Global Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:00 UTC. SOCRadar, its first report on the story. Citrix Patches NetScaler Zero Days Exploited in Global Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:35 UTC. Infosecurity, its first report on the story. Citrix NetScaler Zero Days Exploited in Attacks, Patch Now. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 09:47 UTC. Security Affairs. CISA Warns of Active Exploitation in Critical Citrix NetScaler Flaws. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 12:07 UTC. Rapid7, its first report on the story. Citrix NetScaler Zero Days Expose Appliances to Active RCE Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 13:21 UTC. NCSC, its first report on the story. UK Cyber Agency Urges Action on Exploited Citrix NetScaler Flaws. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 14:30 UTC. The Hacker News, its first report on the story. Hackers Exploit Citrix NetScaler Flaws as Forgotten Assets Fuel Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 15:30 UTC. Unit 42, its first report on the story. Citrix NetScaler Zero Days Exploited as 50,000 Systems Exposed. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 08:00 UTC. SecurityOnline. Critical NetScaler Flaw Lets Attackers Run Root Commands Unauthenticated. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 07:13 UTC. The Hacker News. NetScaler Flaw Exploited to Gain Root Access Before Authentication. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 08:25 UTC. Security Affairs. Citrix NetScaler Zero Day Gives Attackers Tunnels Into Internal Networks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 10:13 UTC. The Hacker News. Attackers Exploit Citrix NetScaler Flaw to Deploy Root Web Shells. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 13:16 UTC. SecurityWeek. Citrix NetScaler Zero Days Let Attackers Steal Credentials Through Web Shells. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 02:14 UTC. SecurityOnline. Active NetScaler Zero Days Expose Devices to Remote Code Execution. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 04:38 UTC. The Hacker News. Attackers Exploit Critical NetScaler Flaw to Steal Configurations. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 10:28 UTC. SecurityOnline. Citrix NetScaler Zero Day Lets Attackers Seize Root Access Without Passwords. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 12:31 UTC. DataBreaches, its first report on the story. Citrix NetScaler Zero Days Exploited Against 50,000 Devices. Cites a CVE in CISA KEV.
  • Fri 2 Oct, 17:05 UTC. Dark Reading, its first report on the story. Citrix NetScaler Zero Days Exploited as Vendors Take Different Risks. Cites a CVE in CISA KEV.
  • Fri 2 Oct, 22:22 UTC. SecurityOnline. Citrix NetScaler Reboots Persist as SAML Flaw Fix Remains Pending. Cites a CVE in CISA KEV.
  • Mon 5 Oct, 05:53 UTC. SecurityWeek. Citrix NetScaler Zero Day Exploited Days After PitScaler Fixes. Cites a CVE in CISA KEV.
  • Wed 7 Oct, 15:08 UTC. SecurityOnline. Four attacker groups exploited Citrix NetScaler flaw to gain privileged access. Cites a CVE in CISA KEV.
  • Mon 19 Oct, 13:24 UTC. Cloudflare, its first report on the story. Citrix NetScaler Flaw Sparks Attacks, Prompting Urgent Patching. Cites a CVE in CISA KEV.
  • Mon 19 Oct, 17:00 UTC. Rapid7. Attackers chained two Citrix NetScaler flaws to gain root access and steal keys. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 11:55 UTC. SecurityWeek. Citrix patches NetScaler flaws after active exploitation. Cites a CVE in CISA KEV.

On 27 September 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added two Citrix NetScaler vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation. The entries are CVE-2026-88771, an improper input validation vulnerability, and CVE-2026-88772, an improper restriction of operations within the bounds of a memory buffer vulnerability. CISA said vulnerabilities of these types are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.

CISA’s Binding Operational Directive (BOD) 26-04 requires Federal Civilian Executive Branch agencies to prioritise rapid remediation of high-risk KEV vulnerabilities on publicly exposed assets that could give an attacker total control after exploitation. It also sets expectations for checking whether threat actors compromised systems before patches were applied.

Although the directive applies only to those agencies, CISA encouraged all organisations to use risk-based vulnerability management and prioritise vulnerabilities listed in the KEV Catalog. The alert did not provide affected NetScaler versions, technical exploitation details or specific remediation instructions beyond prioritising the vulnerabilities and assessing possible compromise.

How the story developed

All 29 articles
Quiet for 2 weekslast report 27 Oct29 articles13 outlets

29 articles from 13 outlets since 27 Sep. Quiet since 27 Oct. This was the 3rd report, 2 hours after the first.

Now27 Sep24682022242628First reportSecurityOnline · 27 Sep, 18:30
  • Sun 27 Sep, 18:30 UTC. SecurityOnline, first report. Citrix NetScaler Zero Days Exploited to Attack VPN Appliances. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 18:30 UTC. Security Affairs, its first report on the story. Citrix NetScaler Zero Days Exploited Against Unpatched Systems. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 20:47 UTC. CISA, its first report on the story. CISA Flags Actively Exploited Citrix NetScaler Flaws for Urgent Action. Cites a CVE in CISA KEV. This article, 3rd of 29.
  • Sun 27 Sep, 20:47 UTC. CISA. CISA Warns Attackers Are Exploiting Critical Citrix NetScaler Zero-Days. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 23:02 UTC. CISA. CISA Warns NetScaler Flaw Is Being Exploited for Command Execution. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:00 UTC. SecurityWeek, its first report on the story. Citrix Patches NetScaler Zero Days Exploited in Global Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:00 UTC. SOCRadar, its first report on the story. Citrix Patches NetScaler Zero Days Exploited in Global Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:35 UTC. Infosecurity, its first report on the story. Citrix NetScaler Zero Days Exploited in Attacks, Patch Now. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 09:47 UTC. Security Affairs. CISA Warns of Active Exploitation in Critical Citrix NetScaler Flaws. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 12:07 UTC. Rapid7, its first report on the story. Citrix NetScaler Zero Days Expose Appliances to Active RCE Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 13:21 UTC. NCSC, its first report on the story. UK Cyber Agency Urges Action on Exploited Citrix NetScaler Flaws. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 14:30 UTC. The Hacker News, its first report on the story. Hackers Exploit Citrix NetScaler Flaws as Forgotten Assets Fuel Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 15:30 UTC. Unit 42, its first report on the story. Citrix NetScaler Zero Days Exploited as 50,000 Systems Exposed. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 08:00 UTC. SecurityOnline. Critical NetScaler Flaw Lets Attackers Run Root Commands Unauthenticated. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 07:13 UTC. The Hacker News. NetScaler Flaw Exploited to Gain Root Access Before Authentication. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 08:25 UTC. Security Affairs. Citrix NetScaler Zero Day Gives Attackers Tunnels Into Internal Networks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 10:13 UTC. The Hacker News. Attackers Exploit Citrix NetScaler Flaw to Deploy Root Web Shells. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 13:16 UTC. SecurityWeek. Citrix NetScaler Zero Days Let Attackers Steal Credentials Through Web Shells. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 02:14 UTC. SecurityOnline. Active NetScaler Zero Days Expose Devices to Remote Code Execution. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 04:38 UTC. The Hacker News. Attackers Exploit Critical NetScaler Flaw to Steal Configurations. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 10:28 UTC. SecurityOnline. Citrix NetScaler Zero Day Lets Attackers Seize Root Access Without Passwords. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 12:31 UTC. DataBreaches, its first report on the story. Citrix NetScaler Zero Days Exploited Against 50,000 Devices. Cites a CVE in CISA KEV.
  • Fri 2 Oct, 17:05 UTC. Dark Reading, its first report on the story. Citrix NetScaler Zero Days Exploited as Vendors Take Different Risks. Cites a CVE in CISA KEV.
  • Fri 2 Oct, 22:22 UTC. SecurityOnline. Citrix NetScaler Reboots Persist as SAML Flaw Fix Remains Pending. Cites a CVE in CISA KEV.
  • Mon 5 Oct, 05:53 UTC. SecurityWeek. Citrix NetScaler Zero Day Exploited Days After PitScaler Fixes. Cites a CVE in CISA KEV.
  • Wed 7 Oct, 15:08 UTC. SecurityOnline. Four attacker groups exploited Citrix NetScaler flaw to gain privileged access. Cites a CVE in CISA KEV.
  • Mon 19 Oct, 13:24 UTC. Cloudflare, its first report on the story. Citrix NetScaler Flaw Sparks Attacks, Prompting Urgent Patching. Cites a CVE in CISA KEV.
  • Mon 19 Oct, 17:00 UTC. Rapid7. Attackers chained two Citrix NetScaler flaws to gain root access and steal keys. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 11:55 UTC. SecurityWeek. Citrix patches NetScaler flaws after active exploitation. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 29 articles as a list
  1. Sun 27 SepDay 05
    1. Citrix NetScaler Zero Days Exploited to Attack VPN Appliances18:30 · SecurityOnline · First report · Known exploited CVE
    2. Citrix NetScaler Zero Days Exploited Against Unpatched Systems18:30 · Security Affairs · Known exploited CVE
    3. CISA Flags Actively Exploited Citrix NetScaler Flaws for Urgent Action20:47 · CISA · official · CISA alert · Known exploited CVE · This article, 3rd of 29
    Show 2 more from 27 Sep
    1. CISA Warns Attackers Are Exploiting Critical Citrix NetScaler Zero-Days20:47 · CISA · official · Known exploited CVE
    2. CISA Warns NetScaler Flaw Is Being Exploited for Command Execution23:02 · CISA · official · Known exploited CVE
  2. Mon 28 SepDay 18
    1. Citrix Patches NetScaler Zero Days Exploited in Global Attacks08:00 · SecurityWeek · Known exploited CVE
    2. Citrix Patches NetScaler Zero Days Exploited in Global Attacks08:00 · SOCRadar · Known exploited CVE
    3. Citrix NetScaler Zero Days Exploited in Attacks, Patch Now08:35 · Infosecurity · Known exploited CVE
    Show 5 more from 28 Sep
    1. CISA Warns of Active Exploitation in Critical Citrix NetScaler Flaws09:47 · Security Affairs · Known exploited CVE
    2. Citrix NetScaler Zero Days Expose Appliances to Active RCE Attacks12:07 · Rapid7 · Known exploited CVE
    3. UK Cyber Agency Urges Action on Exploited Citrix NetScaler Flaws13:21 · NCSC · official · Known exploited CVE
    4. Hackers Exploit Citrix NetScaler Flaws as Forgotten Assets Fuel Attacks14:30 · The Hacker News · Known exploited CVE
    5. Citrix NetScaler Zero Days Exploited as 50,000 Systems Exposed15:30 · Unit 42 · Known exploited CVE
  3. Tue 29 SepDay 21
    1. Critical NetScaler Flaw Lets Attackers Run Root Commands Unauthenticated08:00 · SecurityOnline · Known exploited CVE
  4. Wed 30 SepDay 34
    1. NetScaler Flaw Exploited to Gain Root Access Before Authentication07:13 · The Hacker News · Known exploited CVE
    2. Citrix NetScaler Zero Day Gives Attackers Tunnels Into Internal Networks08:25 · Security Affairs · Known exploited CVE
    3. Attackers Exploit Citrix NetScaler Flaw to Deploy Root Web Shells10:13 · The Hacker News · Known exploited CVE
    4. Citrix NetScaler Zero Days Let Attackers Steal Credentials Through Web Shells13:16 · SecurityWeek · Known exploited CVE
  5. Thu 1 OctDay 44
    1. Active NetScaler Zero Days Expose Devices to Remote Code Execution02:14 · SecurityOnline · Known exploited CVE
    2. Attackers Exploit Critical NetScaler Flaw to Steal Configurations04:38 · The Hacker News · Known exploited CVE
    3. Citrix NetScaler Zero Day Lets Attackers Seize Root Access Without Passwords10:28 · SecurityOnline · Known exploited CVE
    4. Citrix NetScaler Zero Days Exploited Against 50,000 Devices12:31 · DataBreaches · Known exploited CVE
  6. Fri 2 OctDay 52
    1. Citrix NetScaler Zero Days Exploited as Vendors Take Different Risks17:05 · Dark Reading · Known exploited CVE
    2. Citrix NetScaler Reboots Persist as SAML Flaw Fix Remains Pending22:22 · SecurityOnline · Known exploited CVE

  7. Quiet for 2 days

    Mon 5 OctDay 81
    1. Citrix NetScaler Zero Day Exploited Days After PitScaler Fixes05:53 · SecurityWeek · Picked up again · Known exploited CVE

  8. Quiet for 2 days

    Wed 7 OctDay 101
    1. Four attacker groups exploited Citrix NetScaler flaw to gain privileged access15:08 · SecurityOnline · Picked up again · Known exploited CVE

  9. Quiet for 12 days

    Mon 19 OctDay 222
    1. Citrix NetScaler Flaw Sparks Attacks, Prompting Urgent Patching13:24 · Cloudflare · Picked up again · Known exploited CVE
    2. Attackers chained two Citrix NetScaler flaws to gain root access and steal keys17:00 · Rapid7 · Known exploited CVE

  10. Quiet for 8 days

    Tue 27 OctDay 301
    1. Citrix patches NetScaler flaws after active exploitation11:55 · SecurityWeek · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in