U.S. Federal Civilian Agencies Given September 30 Citrix NetScaler Remediation Deadline
SecurityUnverifiedUpdated:
BleepingComputer reports that U.S. Federal Civilian Executive Branch agencies now have until September 30 to secure vulnerable Citrix NetScaler appliances against two flaws described as actively exploited.
Two NetScaler flaws added to KEV
The report says the two critical vulnerabilities, CVE-2026-88771 and CVE-2026-88772, can allow unauthenticated remote code execution on affected NetScaler appliances. It says CISA added them to the KEV catalog after Citrix confirmed active exploitation, with the remediation deadline applying to Federal Civilian Executive Branch agencies.
Citrix had issued security updates for the two NetScaler vulnerabilities. The supplied report does not establish a directly comparable prior federal remediation requirement.
According to the report, CISA added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities catalog and required FCEB agencies to secure vulnerable Citrix appliances by September 30.
The deadline applies to FCEB agencies
The reported action sets a specific remediation deadline for a defined group of U.S. federal agencies in response to vulnerabilities described as under active exploitation.
Sources
- BleepingComputerCISA orders feds to patch exploited Citrix flaws by WednesdayRead source →