Vulnerabilities
CISA Adds CVE‑2026‑88779 to Known Exploited Vulnerabilities Catalog
CISA has added CVE‑2026‑88779, a Citrix NetScaler memory‑buffer overflow that allows attackers to gain full control of exposed assets, to its KEV catalog. Federal agencies must prioritize patching this high‑risk flaw per BOD 26‑04, while all organizations are encouraged to follow the same risk‑based approach. Defenders should verify patch status, monitor for exploitation indicators, and consider submitting unlisted KEVs.
CISA has listed CVE‑2026‑88779 in its Known Exploited Vulnerabilities catalog after confirming active exploitation. The flaw is an improper restriction of operations within a memory buffer in Citrix NetScaler, enabling remote attackers to execute arbitrary code with full control over the affected device.
Impact
- Citrix NetScaler appliances exposed to the internet are at risk of remote code execution.
- Successful exploitation grants attackers complete administrative control.
- Federal Civilian Executive Branch agencies are required to remediate this vulnerability promptly under BOD 26‑04.
What to Do
- Confirm that all NetScaler instances are running the latest patch that addresses CVE‑2026‑88779.
- Apply the patch immediately if not yet installed; verify with cve-check or vendor documentation.
- Monitor logs for signs of buffer‑overflow exploitation attempts and isolate affected systems if necessary.
Additional Guidance
CISA urges all organizations, not just federal agencies, to adopt a risk‑based vulnerability management strategy and prioritize remediation of KEV catalog entries. If you encounter an actively exploited vulnerability that is not yet listed, submit it via the KEV Nomination Form, ensuring a CVE ID, exploitation evidence, and mitigation steps are provided.
Related vulnerabilities
CISA Adds CVE-2026-21589 to Known Exploited Vulnerabilities Catalog
CISA has added CVE-2026-21589, a file and directory disclosure flaw in multiple Atlassian products, to its Known Exploited Vulnerabilities catalog. Federal agencies must prioritize patching and verify that exposed assets are not compromised. All organizations should adopt risk‑based remediation for KEV entries.
Read briefing
CISA Adds WordPress Remote File Inclusion CVE-2026-87902 to KEV Catalog
CISA has added CVE-2026-87902, a WordPress Core Remote File Inclusion flaw, to its Known Exploited Vulnerabilities catalog after confirmed active exploitation. Federal agencies must prioritize patching, and all organizations should treat the vulnerability as high risk and follow remediation guidance.
Read briefing
CISA Adds Four Exploited Vulnerabilities to KEV Catalog
CISA has added four CVEs—CVE‑2026‑0322, CVE‑2026‑76519, CVE‑2026‑105133, CVE‑2026‑105134—to its Known Exploited Vulnerabilities catalog. The vulnerabilities affect Palo Alto Networks PAN‑OS, Cisco Secure Email Gateway, and Ahsay AhsayCBS, and grant attackers full control of exposed assets. Defenders should prioritize patching and verify no compromise before applying updates.
Read briefing
CISA Adds Zimbra OS Command Injection CVE‑2026‑73570 to KEV Catalog
CISA has just added CVE‑2026‑73570, an OS command injection vulnerability in Zimbra Collaboration Suite, to its Known Exploited Vulnerabilities (KEV) list after confirmed active exploitation. Federal agencies are now required to patch this flaw immediately under BOD 26‑04, while all organizations are urged to adopt a risk‑based remediation strategy. The KEV catalog will expand as more exploited CVEs surface, and entities can nominate new entries via CISA’s KEV Nomination Form.
Read briefing