CISA orders feds to patch Citrix NetScaler RCE flaw by Saturday

Summary

CISA has mandated that U.S. government agencies patch a critical remote code execution vulnerability (CVE-2026-8452) in Citrix NetScaler appliances by Saturday. This high-severity flaw, initially thought to only allow DoS attacks, has been shown to enable RCE as root. The vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.

Full text

CISA orders feds to patch Citrix NetScaler RCE flaw by Saturday By Sergiu Gatlan August 27, 2026 05:16 AM 0 The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered government agencies to patch their Citrix NetScaler appliances against an actively exploited vulnerability by Saturday. Tracked as CVE-2026-8452, this high-severity security flaw stems from a memory overflow weakness affecting NetScaler ADC and NetScaler Gateway appliances configured with Gateway VPN or AAA (Authentication, Authorization, and Auditing) virtual servers. While Citrix said in June that threat actors could only exploit the flaw in denial-of-service (DoS) attacks, cybersecurity firm watchTowr showed in August that successful exploitation can also allow attackers to gain remote code execution as root on unpatched NetScaler instances. "This is a memory overflow vulnerability that may lead to unpredictable behavior or denial of service and impacts NetScaler Gateway or AAA virtual server," Citrix said at the time. "We have not observed any unmitigated exploitation of this vulnerability as well." At the moment, Internet threat watchdog Shadowserver tracks over 22,000 NetScaler ADC appliances and nearly 1,800 Gateway instances exposed online. However, there is no information on how many are honeypots, have vulnerable configurations, or have already been patched. Citrix NetScaler appliances exposed online (Shadowserver) ​​On Monday, CISA added the CVE-2026-8452 flaw to its Known Exploited Vulnerabilities (KEV) Catalog, ordering Federal Civilian Executive Branch (FCEB) agencies to secure all vulnerable Citrix appliances by August 29, as mandated by Binding Operational Directive (BOD) 26-04. CISA didn't share any details on the attacks currently targeting the CVE-2026-8452 flaw, but its warning comes one week after security researchers and cybersecurity experts flagged the vulnerability as actively exploited in "pray and spray" attacks that deploy web shells on compromised appliances. Citrix has yet to update the security advisory for the CVE-2026-8452 vulnerability to acknowledge that it's now being targeted in the wild. One week ago, the company also urged customers to immediately secure their systems against two other NetScaler vulnerabilities, tracked as CVE-2026-19490 and CVE-2026-19489, that remote, unauthenticated threat actors can exploit in DoS attacks or to bypass authentication. While these two flaws have not been tagged as exploited in the wild, Citrix asked admins to patch two other NetScaler vulnerabilities (CVE-2026-3055 and CVE-2026-4368) in March, days before threat actors began abusing them. Since November 2021, the U.S. cybersecurity agency has flagged 23 Citrix vulnerabilities as exploited in the wild, seven of them also abused by ransomware gangs. Once attackers have valid credentials, only 37% of their actions are blocked Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report Related Articles: CISA orders urgent patching of actively exploited Zimbra flawCritical RCE flaw in Windows IKE Extension now actively exploitedCitrix urges admins to patch new NetScaler flaws as soon as possibleCISA: Microsoft SharePoint flaw now exploited in ransomware attacksCISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws

Indicators of Compromise

• cve — CVE-2026-8452
• cve — CVE-2026-19490
• cve — CVE-2026-19489
• cve — CVE-2026-3055
• cve — CVE-2026-4368

Entities