CISA Sets September 30 Deadline for Federal Agencies to Patch Actively Exploited Citrix NetScaler Zero-Days
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has set September 30 as the deadline for federal agencies to patch two actively exploited zero-day vulnerabilities in Citrix NetScaler products. The flaws, identified as CVE-2026-88771 and CVE-2026-88772, permit unauthenticated remote code execution under typical deployment conditions and target perimeter devices such as remote access gateways and application publishing services.
CVE-2026-88771 is particularly severe because it allows remote code execution without authentication on NetScaler ADC and NetScaler Gateway using default settings. No additional requirements or credentials are needed, leaving unpatched systems fully exposed to attackers. CVE-2026-88772 can result in either remote code execution or denial of service through a memory overflow triggered when DTLS is enabled on VPN vServers, a configuration that is active by default in many deployments.
Citrix has published updates for the 14.1 and 13.1 branches, including FIPS and NDcPP certified builds. Administrators must apply at minimum version 14.1-73.37 or 13.1-64.23 (or their certified equivalents). Deployments of Secure Private Access Hybrid that rely on NetScaler instances inherit the same risk and require the same remediation.
The security bulletin also addresses six additional vulnerabilities ranging from CVE-2026-88773 to CVE-2026-88778. These include HTTP request smuggling, policy bypass issues, and techniques related to TCP ISN prediction. For the TCP ISN case, Citrix provides a recommended configuration change to mitigate specific scenarios when the affected functionality is in use.
CISA advises organizations to look for signs of compromise before applying patches when feasible and to preserve forensic evidence if compromise is suspected. In environments with limited telemetry, reviewing logs in NetScaler Console and engaging specialized forensic analysis can help distinguish between simply closing the vulnerability and leaving a latent intrusion undetected.
Non-federal organizations should follow the same urgency: first inventory all NetScaler instances, prioritize those exposed to the internet, verify DTLS status on VPN vServers, and schedule maintenance windows with rollback plans. NetScaler 12.1 and 13.0 are no longer supported and will not receive patches, making immediate migration to supported branches the only viable option.
Related articles
Use-After-Free in HTTP/2 Upload Leads to Potential RCE in curl: Detailed Analysis of CVE-2026-92392
In curl 8.23.0, developers fixed a high-severity Use-After-Free vulnerability tracked as CVE-2026-92392 that could allow remote code execution during HTTP/2 uploads. The flaw stems from a dangling pointer left on an easy handle after a server resets an HTTP/2 stream, which later gets dereferenced when the multi handle closes. An attacker controlling the server can influence memory contents to hijack a function pointer and execute arbitrary code, though successful exploitation requires precise conditions including upload size, memory layout, and knowledge of the target architecture. The issue was discovered by Luna Tong at Anthropic using their OSS Scanner and reported to the curl security team on September 15. The team accelerated the release cycle by two weeks to deliver the fix while maintaining standard procedures. curl maintainers continue reducing internal handle pointers in favor of identifiers and are adding more tests and static analysis to prevent similar memory-safety errors. The vulnerability highlights ongoing risks in C-based networking code handling multiplexed protocols like HTTP/2.
Automating Asset Scanning in MaxPatrol VM via API: Part 4 on Authentication
A detailed technical guide explains how to build asset scanning automation in MaxPatrol VM using its API, starting with authentication methods. The author covers three authorization options including local account login-password, domain account credentials, and reference tokens, providing working Python examples for local accounts. Code reads secrets from an .env file and obtains a Bearer token valid for 24 hours from the Core role instance. The post details required privileges in both the Management Console and MaxPatrol 10 for tasks such as vulnerability exports, dynamic asset group management, scan task creation, and report exporting. It credits Alexey Leonov for an early GitHub script that enabled practical API usage and lists additional resources including webinars, SDK, CLI, Jira integration, and a Postman collection. All subsequent API calls rely on the generated headers containing the Bearer token.
Securing Hadoop Clusters: Removing Passwords from XML Configs with Credential Provider API and JCEKS
Hadoop configurations frequently expose sensitive credentials such as database passwords and cloud access keys in plain text within files like hive-site.xml and core-site.xml. The Credential Provider API, introduced in Hadoop 2.6, allows applications to retrieve secrets from an external JCEKS keystore instead of embedding them directly in XML. This mechanism uses conf.getPassword() to fetch decrypted values from the keystore when hadoop.security.credential.provider.path is configured. JCEKS relies on the outdated PBEWithMD5AndTripleDES algorithm, which remains vulnerable to Sweet32 attacks in theory though practical risk for small keystore files is low. Master password protection for the keystore itself is the weakest link, with options including environment variables, protected password files, or HDFS Transparent Data Encryption. Arenadata has automated credential encryption management in its ADH platform through ADCM to handle keystore creation, permission setting, and rotation across cluster nodes.
CISA Adds Five Exploited Vulnerabilities to KEV Catalog Including AhsayCBS Authentication and Command Injection Flaws
The US Cybersecurity and Infrastructure Security Agency (CISA) has added five vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. Four vulnerabilities were registered on October 14, 2026, and one additional entry followed on October 15. Among the newly listed issues are two critical flaws affecting the AhsayCBS backup management server: CVE-2026-105133, an authentication bypass in the API, and CVE-2026-105134, a command injection vulnerability in the replication feature. When chained together, the pair allows unauthenticated remote attackers to execute arbitrary operating system commands. Vendor Ahsay has released hotfixes in versions 10.3.4.45 and 9.15.2.70 because standard patches cannot fully address the issues. The advisory also references vulnerabilities in Atlassian products and multiple network security solutions from other vendors.