Grade One Press

Technology reporting you can check

News · Security & privacy

Two new Citrix NetScaler flaws are being exploited, and US agencies were given three days to act

One lets an unauthenticated attacker run commands on the widely used remote-access and load-balancing appliances. It is the third NetScaler flaw CISA has listed as exploited this month.

Grade One Newsroom · 1 min read

Sources: 3 · top grade 1How evidence is graded

Two critical Citrix NetScaler flaws are being exploited, the US cyber agency says

Grade 1 · Primary

Source: US Cybersecurity and Infrastructure Security Agency (CISA)

What changed
CISA listed two Citrix NetScaler ADC and Gateway flaws as exploited on 27 September, the day they were published, with a 30 September deadline for US agencies.
Who it affects
Organisations running NetScaler ADC or NetScaler Gateway older than versions 14.1-73.37 and 13.1-64.23, including the FIPS editions.
What it does not tell you
How many appliances are exposed or have been breached, or who is behind it. Neither CISA nor the vulnerability database says.

The full story Check the source

The US Cybersecurity and Infrastructure Security Agency added two flaws in Citrix NetScaler ADC and NetScaler Gateway to its catalogue of exploited vulnerabilities on 27 September. It gave federal agencies until 30 September to deal with them [1].

One, CVE-2026-88771, lets an unauthenticated attacker execute arbitrary commands. NIST scores it 9.8 out of 10 [1][2].

The other, CVE-2026-88772, is a memory-buffer flaw that could allow remote code execution or denial of service [1][3].

On 9 September CISA had listed a different NetScaler flaw, an authentication bypass, as exploited [1].

What it covers

NetScaler ADC and NetScaler Gateway versions before 14.1-73.37 and before 13.1-64.23, and the FIPS and NDcPP editions before 14.1-73.37 and 13.1.37.279 [2].

CISA's entry for the earlier flaw describes Gateway set-ups used as an SSL VPN and as remote-access proxies [1].

CISA tells agencies to apply Citrix's fixes, check for signs of compromise, and stop using the product where fixes cannot be applied [1].

What it does not tell you

How many appliances are exposed or have been compromised, or who is exploiting the flaws. The sources do not say [1][2].

Sources and their grades

  1. US Cybersecurity and Infrastructure Security Agency (CISA), Known Exploited Vulnerabilities Catalog, entries CVE-2026-88771 and CVE-2026-88772. Read 29 September 2026. Grade 1 · Primary Added 27 September 2026, due 30 September. A listing means CISA has evidence of exploitation.
  2. US National Vulnerability Database (NIST), CVE-2026-88771. Read 29 September 2026. Grade 1 · Primary Published 27 September 2026. Affected and fixed versions; severity scores from NIST and from the reporting organisation.
  3. US National Vulnerability Database (NIST), CVE-2026-88772. Read 29 September 2026. Grade 1 · Primary Published 27 September 2026.

A grade says how much weight a source will take, from 1 (a body that can compel an answer and has nothing to sell) to 5 (somebody describing what they sell, or themselves). The standard sets out what each grade may be used for.

Filed under Remote access Vulnerabilities

Comments

Commenting needs an account, made with nothing but an email address. A first comment is read before it appears.

More news

See all