Three days to patch the gateway

At 21:30 UTC on Sunday the Cybersecurity and Infrastructure Security Agency published version 2026.09.27 of its Known Exploited Vulnerabilities catalogue. It added two flaws in Citrix NetScaler ADC and NetScaler Gateway, the appliances that sit at the edge of a network and let remote users and outside traffic in. Both are marked as exploited in the wild. Both carry a due date of Wednesday 30 September, and both carry a flag that no catalogue entry carried before July: forensic triage required.

The first, CVE-2026-88771, is an input validation flaw that "could allow an unauthenticated attacker to execute arbitrary commands", in CISA's wording. The second, CVE-2026-88772, is a memory-buffer flaw that can lead to remote code execution or denial of service. Fixed builds are 14.1-73.37 and 13.1-64.23, with separate numbering for the FIPS editions. Citrix scores both 9.5 out of 10 under version 4 of the scoring system. NVD, scoring under version 3.1, gives the first 9.8 and the second 8.1, rating the second's attack complexity high. The researchers at watchTowr were first to report exploitation, according to The Hacker News.

Citrix's bulletin covers CVE-2026-88771 through CVE-2026-88778, which is eight identifiers, two of which CISA has listed. The bulletin itself refused automated requests from this desk. One clerical point for anyone scripting against the catalogue: CISA's entry for 88771 links to the NVD page for 88772. Both entries point to the same page.

The pattern is the story. NetScaler has been added to the catalogue five times this year: on 30 March, 26 August, 9 September and now twice on 27 September. Four of those five came in the last 32 days. Citrix products account for 26 entries in the catalogue in all.

The deadline is the other half. Through 2025 a KEV listing gave federal civilian agencies 21 days to remediate in almost every case; the median window was 21 days in each of 2023, 2024 and 2025. Binding Operational Directive 26-04, issued on 10 June, revoked that regime and replaced it with timelines keyed to whether an asset is exposed to the internet, whether exploitation can be automated and how much control it gives an attacker. Where an entry carries the forensic flag, the directive requires agencies to "complete remediation or mitigation action within the timeline (three days) and carry out a forensic triage of the asset to assess whether the system is compromised". The directive gives its reason plainly: attackers' "use of AI may further narrow the time defenders have to react between patch release and possible exploitation".

The catalogue shows the change arriving in steps. The median window on entries added in January and February was 21 days; from March to May it was 14; from June to September it has been three. September has brought 41 additions so far, more than any other month this year. An agency security team that once had three weeks per entry now has three days, and gets more entries.

The forensic requirement is what makes Wednesday hard. A patch closes the door; it says nothing about who came through it before it was closed. CISA's notes tell agencies to run Citrix's indicators of compromise in the NetScaler console and to follow Citrix's published steps for appliances suspected of compromise. For an appliance exploited before a fix existed, the second task is the larger one, and three days is the time allowed for both.

The deadline binds only federal civilian agencies. The directive excludes national security systems, and "unless directed by the governing procurement contract, this Directive does not apply to contractors". Everyone else running a NetScaler, which is most large companies and a great many state and local governments, has the same exposure and no deadline at all. The FBI is finding out this week what that gap can cost.