CISA Orders Patch for Actively Exploited Citrix NetScaler DoS Flaw
Summary
CISA ordered federal agencies to patch actively exploited Citrix NetScaler vulnerability CVE-2026-88779 by Wednesday and conduct forensic triage. Citrix says the flaw can disrupt availability but has not identified an impact on data integrity.
Key points
- Citrix disclosed CVE-2026-88779 after reports of targeted attacks against unmitigated NetScaler deployments.
- The vulnerability can crash NetScaler appliances and cause denial of service; repeated triggering may keep services unavailable.
- Citrix said it has not identified an impact on customer data integrity.
- CISA ordered federal agencies to patch the flaw by Wednesday and conduct forensic triage.
- Citrix released mitigations for use before upgrading and credited Bishop Fox and watchTowr with helping identify the issue.
- Organizations are also responding to active exploitation of CVE-2026-88771 and CVE-2026-88772; Mandiant reported likely impacts across multiple sectors in North America and Europe.
Article Details
- Vulnerability Types
- Denial of Service
- Severity
- 8.7 out of 10
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- unknown
MITRE ATT&CK
CVE
CVE-2026-88771Citrix NetScaler · ADC; Citrix NetScaler · GatewayThe issue comes as organizations are still responding to widespread exploitation of CVE-2026-88771 and CVE-2026-88772, with Mandiant reporting likely impacts across multiple sectors in North America and Europe.CVE-2026-88772Citrix NetScaler · ADC; Citrix NetScaler · GatewayThe issue comes as organizations are still responding to widespread exploitation of CVE-2026-88771 and CVE-2026-88772, with Mandiant reporting likely impacts across multiple sectors in North America and Europe.CVE-2026-88779NetScaler · ADC; NetScaler · GatewayA new Citrix NetScaler vulnerability, CVE-2026-88779, is being actively exploited to crash appliances and cause Denial of Service, prompting urgent patch orders from CISA and warnings from Citrix.
People
Vendors
Products
GatewayCitrix NetScaler application delivery controllers (ADC) and Gateway devices are used by large organizations to manage traffic and authentication.NetScalerA new Citrix NetScaler vulnerability, CVE-2026-88779, is being actively exploited to crash appliances and cause Denial of Service, prompting urgent patch orders from CISA and warnings from Citrix.NetScaler ADC
Industries
Educationof organizations in North America and Europe in the government, financial services, technology, education, and legal and professional services sectors that were likely impacted by this exploitation campaign.Financial ServicesMandiant added that it has evidence of organizations in North America and Europe in the government, financial services, technology, education, and legal and professional services sectors that were likely impacted byGovernmentA new vulnerability is giving cybercriminals the ability to crash Citrix NetScaler appliances, prompting urgent warnings from multiple government agencies.legal and professional servicesNorth America and Europe in the government, financial services, technology, education, and legal and professional services sectors that were likely impacted by this exploitation campaign.Technologyit has evidence of organizations in North America and Europe in the government, financial services, technology, education, and legal and professional services sectors that were likely impacted by this exploitation