Citrix: 2 Actively-Exploited Flaws Added to CISA KEV
CISA has added two actively-exploited vulnerabilities affecting Citrix products to its Known Exploited Vulnerabilities Catalog, underscoring the immediate threat these flaws pose to organizations.
Key findings
- Two Citrix vulnerabilities, CVE-2026-88771 and CVE-2026-88772, added to CISA KEV.
- Both flaws are confirmed to be under active exploitation by threat actors.
- Immediate patching and mitigation are critical for all organizations using affected Citrix products.
- CISA's KEV listing mandates rapid remediation for federal agencies.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert by including two critical Citrix vulnerabilities, CVE-2026-88771 and CVE-2026-88772, in its Known Exploited Vulnerabilities (KEV) Catalog. This addition signifies that these flaws are under active exploitation by malicious actors in the wild, making them a significant and immediate risk to any organization utilizing affected Citrix products. The KEV catalog serves as a definitive list of vulnerabilities that federal civilian executive branch (FCEB) agencies are required to remediate within specific deadlines, but its implications extend to all organizations, highlighting vulnerabilities that are actively being leveraged in attacks.
The two vulnerabilities are:
- **CVE-2026-88771**: This vulnerability, while specific details are pending public disclosure, has been confirmed by CISA as actively exploited, indicating a high potential for unauthorized access or system compromise.
- **CVE-2026-88772**: Similar to its counterpart, CVE-2026-88772 is also under active exploitation, posing a critical risk to the confidentiality, integrity, and availability of systems.
The inclusion of these vulnerabilities in the KEV catalog mandates that federal agencies address them by a specific due date, typically within two weeks of their listing. For all other organizations, this serves as a critical warning to prioritize patching and mitigation efforts immediately. Active exploitation means that threat actors are already leveraging these weaknesses to gain footholds in networks, deploy malware, or exfiltrate data. Organizations should not delay in identifying all affected Citrix assets and applying the necessary security updates or workarounds provided by the vendor.
Defenders are strongly advised to review their environments for any instances of affected Citrix products. Immediate action should include applying all available patches, monitoring network traffic for indicators of compromise related to these CVEs, and implementing robust segmentation to limit potential lateral movement if an exploit is successful. Proactive vulnerability management, coupled with a swift response to CISA's KEV alerts, is essential to protect against the most pressing cyber threats.