CISA adds Citrix NetScaler to KEV with Sept. 30 deadline
CISA added Citrix NetScaler flaws to its known-exploited list Sunday and set a Sept. 30 fix deadline for federal agencies. That lands after September's record Microsoft Patch Tuesday and under a newer risk-based federal patch clock.
CISA added Citrix NetScaler ADC and Gateway flaws to its Known Exploited Vulnerabilities catalog on Sunday, including CVE-2026-88771. The catalog says the products have an improper input validation bug that could let an unauthenticated attacker run commands. CISA set a Sept. 30 remediation deadline for covered federal systems and flagged forensic triage under Binding Operational Directive 26-04.
That Sunday add is the live weekend patch story, not a single brand-name consumer zero-day on Trends. Operators still have to clear September's bigger Microsoft release and keep watching the catalog for new entries. The Record reported on Sept. 8 that Microsoft's Patch Tuesday topped 900 fixed bugs for the first time — about 973 in that count — and that CISA confirmed two were already being exploited: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows Advanced Local Procedure Call. Federal agencies had until Sept. 22 to patch those two.
Security researchers told The Record the Update Stack bug is especially ugly because it sits in the same plumbing used to install fixes. Automox engineer Serena DiPenti said an attacker who owns the update stack owns the tool you would use to kick them out. Tenable's Satnam Narang tied CVE-2026-81963 to the Windows update component and CVE-2026-85880 to a Windows messaging system. Separate vendor tallies put the Microsoft September total near 964 to 972 CVEs, with more than 100 rated critical.
The policy backdrop is BOD 26-04, issued June 10, 2026. It replaced older fixed KEV clocks with risk-based timelines that weigh public exposure, KEV status, how automatable an exploit is, and technical impact. High-risk, publicly exposed KEVs can carry windows as short as three calendar days, plus forensic triage in some cases. Sunday's Citrix entries again point agencies to that directive and to Citrix's published mitigations.
NIST's SP 800-40 Rev. 4, finalized in April 2022, still frames the boring work underneath those spikes: identify, prioritize, acquire, install, and verify patches across an enterprise. The guide treats patching as preventive maintenance and a cost of doing business, not an optional security project. That matches how desks talk about weekend hygiene after a record Patch Tuesday and a same-day KEV add — triage the exploited and internet-facing systems first, then grind through the rest of the queue before the next catalog update lands.
Where outlets agree CISA, The Record, and NIST agree the live cyber priority remains known-exploited flaws and disciplined patch queues: CISA's KEV catalog names what is already abused in the wild, September's Microsoft release set a record volume of fixes, and NIST frames enterprise patching as ongoing preventive maintenance.
Where they differ The Record stresses vendor volume and exploited Windows Update Stack and ALPC zero-days from Patch Tuesday; CISA's Sunday KEV add centers Citrix NetScaler with a Sept. 30 federal deadline and BOD 26-04 forensic triage; NIST stays on long-term planning rather than any single CVE clock. How tightly private-sector teams should treat federal KEV windows as binding versus advisory remains open.