CISA Orders Federal Patch of Exploited Citrix Flaws

Citrix confirmed active exploitation of two critical NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, which allow unauthenticated remote code execution. CISA added both to its Known Exploited Vulnerabilities catalog and ordered Federal Civilian Executive Branch agencies to secure vulnerable appliances by September 30. Shadowserver tracks over 23,000 exposed NetScaler IP addresses, and Citrix warns its generic indicators of compromise may have limited forensic value.