CISA Sets September 30 Deadline for Federal Agencies to Patch Actively Exploited Citrix NetScaler Zero-Days
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has set September 30 as the deadline for federal agencies to patch two actively exploited zero-day vulnerabilities in Citrix NetScaler products. The flaws, identified as CVE-2026-88771 and CVE-2026-88772, permit unauthenticated remote code execution under typical deployment conditions and target perimeter devices such as remote access gateways and application publishing services.
CVE-2026-88771 is particularly severe because it allows remote code execution without authentication on NetScaler ADC and NetScaler Gateway using default settings. No additional requirements or credentials are needed, leaving unpatched systems fully exposed to attackers. CVE-2026-88772 can result in either remote code execution or denial of service through a memory overflow triggered when DTLS is enabled on VPN vServers, a configuration that is active by default in many deployments.
Citrix has published updates for the 14.1 and 13.1 branches, including FIPS and NDcPP certified builds. Administrators must apply at minimum version 14.1-73.37 or 13.1-64.23 (or their certified equivalents). Deployments of Secure Private Access Hybrid that rely on NetScaler instances inherit the same risk and require the same remediation.
The security bulletin also addresses six additional vulnerabilities ranging from CVE-2026-88773 to CVE-2026-88778. These include HTTP request smuggling, policy bypass issues, and techniques related to TCP ISN prediction. For the TCP ISN case, Citrix provides a recommended configuration change to mitigate specific scenarios when the affected functionality is in use.
CISA advises organizations to look for signs of compromise before applying patches when feasible and to preserve forensic evidence if compromise is suspected. In environments with limited telemetry, reviewing logs in NetScaler Console and engaging specialized forensic analysis can help distinguish between simply closing the vulnerability and leaving a latent intrusion undetected.
Non-federal organizations should follow the same urgency: first inventory all NetScaler instances, prioritize those exposed to the internet, verify DTLS status on VPN vServers, and schedule maintenance windows with rollback plans. NetScaler 12.1 and 13.0 are no longer supported and will not receive patches, making immediate migration to supported branches the only viable option.
Related articles
PHP2Shell Vulnerabilities Enable Pre-Application Code Execution on Unpatched Servers
The article explains how attackers can exploit two known PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, to run arbitrary code inside the PHP process before any application-level code executes. This grants the attacker the same privileges as the PHP user, typically www-data on Ubuntu systems running Apache with mod_php, allowing access to configuration files, database credentials, and the ability to write malicious files if permissions permit. The author demonstrates practical attack paths including reading config.php files, connecting directly to MySQL databases, and creating persistent backdoors such as hack.php that execute shell commands via URL parameters. Even when standard hardening measures like open_basedir, disabled dangerous functions, and separate system users are applied, the attacker can still execute code within PHP limits until the vulnerabilities are patched. The recommended immediate actions include updating PHP, restricting write permissions, disabling PHP execution in upload directories, and placing a hardened reverse proxy such as Cloudflare in front of legacy servers while blocking all direct traffic via firewall rules.
Citrix Issues Critical XenServer Patches for Host Compromise Vulnerabilities
Citrix published security bulletin CTX697256 on November 3, 2026, disclosing eight vulnerabilities affecting XenServer. The most severe issue, tracked as CVE-2026-98432 and rated critical, enables an unauthenticated attacker who reaches the management network to compromise the virtualization host and associated appliances. A second flaw, CVE-2026-102703, allows a privileged user inside a guest virtual machine to break out and take control of the underlying host, violating isolation guarantees. Six additional vulnerabilities impact network boot and secure boot processes, potentially allowing attackers to compromise VMs during startup or bypass code-signing policies. Affected products include XenServer 8.4 and 9 along with Workload Balancing and Conversion Manager appliances. Citrix recommends immediate application of the fixes and temporary isolation of the management network while updates are deployed.
Microsoft Paint Patch for CVE-2026-83844 Fails to Reach Some Windows 11 Users via Microsoft Store
Microsoft fixed a remote code execution vulnerability in the Paint application for Windows 11, but the update is not reaching all users through the Microsoft Store. The flaw, tracked as CVE-2026-83844, carries a CVSS score of 8.1 and involves an out-of-bounds memory read that could allow unauthenticated network attacks. Although exploitation is rated as highly complex, the issue is classified as important by Microsoft. The patch is delivered separately from Windows Update, requiring users to verify the Paint version manually in the Microsoft Store. The clean version is listed as 11.2609.401.0, yet multiple systems remain on 11.2603.251.0 despite automatic updates being enabled. Windows Latest reported the distribution problem after checking its own systems and collecting similar reports from administrators. No real-world exploitation of the vulnerability has been observed so far.
Mozilla Releases Firefox 159.0.1 to Patch High-Severity Layout Vulnerability CVE-2026-120572
Mozilla Foundation has issued Firefox 159.0.1 to address a high-severity vulnerability tracked as CVE-2026-120572. The flaw resides in the Layout: Block and Inline component responsible for web page rendering. It stems from improper handling of boundary conditions during layout processing. CISA assigned the issue a CVSSv3.1 base score of 8.8, confirming high impact. The update was published on November 3, 2026, and is rated high severity by both Mozilla and CISA. Users are advised to apply the patch immediately to mitigate potential exploitation risks.