Digest · Sunday

Security digest: September 27, 2026

1 editorial brief and 2 known exploited (cisa kev) additions.

All digests · RSS · Markdown

Take stock

Act now: NetScaler CVE-2026-88771/88772: Exploited Pre-Auth RCE. All customer-managed NetScaler ADC and Gateway 14.1 and 13.1 (including FIPS/NDcPP and Secure Private Access hybrid) deployments.
Do you run any of these? Citrix NetScaler. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-09-30.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

Sep 27, 2026 · Vulnerability · CVE-2026-88771, CVE-2026-88772

NetScaler CVE-2026-88771/88772: Exploited Pre-Auth RCE

Every customer-managed NetScaler ADC or Gateway needs the latest build today, and any appliance that was unpatched in September should be investigated as compromised, because patching does not evict attackers.

Must act: All customer-managed NetScaler ADC and Gateway 14.1 and 13.1 (including FIPS/NDcPP and Secure Private Access hybrid) deployments.

Can relax: Citrix-managed cloud services and Adaptive Authentication customers, which Citrix updates itself.

Preserve evidence first: VPX snapshot, tech-support bundle, packet engine core dump, remote syslog
Run Citrix's NetScaler Console IOC scan and Unit 42 hunting checks
Upgrade to 14.1-73.41 / 13.1-64.28 (or FIPS equivalents), which also cover the SAML follow-up CVE-2026-88779

Read the brief →

Known exploited (CISA KEV) 2

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVE	Product and flaw	CISA due
CVE-2026-88772	Citrix NetScaler Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability	2026-09-30
CVE-2026-88771	Citrix NetScaler Citrix NetScaler Improper Input Validation Vulnerability	2026-09-30

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.