U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

• CVE-2026-88771 (CVSS score: 9.5) Citrix NetScaler Improper Input Validation Vulnerability
• CVE-2026-88772 (CVSS score: 9.5) Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

CVE-2026-88771 (CVSS score: 9.5) is a remote code execution vulnerability caused by improper input validation that could allow an unauthenticated remote attacker to execute arbitrary commands. The flaw affects all NetScaler ADC and NetScaler Gateway deployments in their default configuration and does not require any additional features to be enabled.

CVE-2026-88772 (CVSS score: 9.5) is a memory buffer overflow vulnerability that could allow remote code execution or cause a denial-of-service condition. The flaw affects NetScaler ADC and NetScaler Gateway deployments with DTLS enabled, which is enabled by default on VPN vServers. The vulnerability is classified as CWE-119.

This week, Citrix confirmed that the two critical zero-day vulnerabilities in NetScaler ADC and NetScaler Gateway were exploited before the company released patches. The flaws allow remote code execution, meaning attackers can potentially take control of affected appliances. The first warnings did not come from Citrix. On September 26, administrators said IT providers and security teams were privately advising them to take NetScaler systems offline, sometimes without explaining why.

The two zero-day issues are not related to NetScaler vulnerabilities CVE-2026-19490 and CVE-2026-19489 that were disclosed in August.

The reports show how the attacks were already underway while defenders were still waiting for official details and fixes.

Security researchers at watchTowr then confirmed that the reports were credible. The company said it was investigating reports of multiple unpatched NetScaler remote code execution flaws being exploited in the wild and later said the vulnerabilities had been found during forensic investigations.

“We are currently rapidly reacting to rumors that multiple unpatched Citrix NetScaler RCE vulnerabilities are circulating in the wild. While details are scarce, the information is credible,” watchTowr wrote on X.

The Dutch National Cyber Security Centre also sent a pre-notification to organizations in the Netherlands. According to a notice seen by BleepingComputer, a European partner CERT had shared information about two critical NetScaler zero-days that could allow remote code execution. One of the flaws could even let an attacker inject shellcode directly into memory.

Both vulnerabilities have been fixed in the following NetScaler releases:

• Citrix NetScaler ADC and NetScaler Gateway 14.1-73.37 and later
• Citrix NetScaler ADC and NetScaler Gateway 13.1-64.23 and later
• Citrix NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS and later
• Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.279 and later

CISA said it has received reports and threat intelligence confirming that attackers are actively exploiting the vulnerabilities worldwide.

“CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally. Because updating Citrix NetScaler appliances can be complex and may require downtime, CISA is issuing this Alert to help organizations assess exposure, prioritize mitigation, and account for these vulnerabilities into their risk-management activities.” reads the advisory published by CISA. “Given the potential consequences of successful exploitation and the fact that malicious actors are exploiting at least some of these vulnerabilities, CISA urges users and administrators to review Citrix’s advisories.”

CISA also noted that updating NetScaler appliances can be complex and may require downtime. The alert is intended to help organizations assess their exposure, prioritize mitigation and include the vulnerabilities in their risk management plans.

Citrix has also released generic indicators of compromise (IoCs) through NetScaler Console. These can help customers check whether their systems may have been compromised.

If a compromise is suspected, Citrix recommends taking the following steps:

• Preserve evidence from the NetScaler ADC VPX instance.
• Isolate the device.
• Revoke credentials and access.
• Check connected servers and systems for signs of further compromise.
• Rebuild the device and update it to the latest firmware.
• Rotate local account passwords and Key Encryption Keys (KEK), and replace restored SSL certificates when recovering from a known-good backup.
• Harden the device according to Citrix security best practices.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaws by September 30, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

Hackers are actively exploiting CVE-2026-87902, a critical WordPress flaw that can lead to remote code execution. Here’s what admins should do.

The post WordPress Flaw Under Active Attack: Hackers Target CVE-2026-87902 for Code Execution appeared first on TechRepublic.

An exploited WordPress RCE vulnerability (CVE-2026-87902) is under attack. Details and PoC exploit code are public. Patch your sites now.

Related Posts:

• Ansible Automation Platform Vulnerabilities Allow Exploits
• CVE-2026-48842: Roundcube Webmail Vulnerability Exploited in the Wild
• Critical Rancher XSS Vulnerability Exposes Admin Credentials

The post Exploited WordPress RCE Vulnerability Details and PoC Disclosed appeared first on Daily CyberSecurity.

WordPress 7.1.2 fixes an unauthenticated file inclusion bug active since version 4.7, patchable but exploitable into remote code execution.

WordPress 7.1.2 shipped on September 22 address an unauthenticated local file inclusion, tracked as CVE-2026-87902 (CVSS score of 9.2), which stems of how the CMS resolves page templates, with a real path to remote code execution.

The bugs affected every version back to 4.7.0. That’s nearly a decade of releases, and nobody needs an account to trigger it. Robert Ressl gets credit for reporting it.

The flaw resides in get_page_template(), the function WordPress uses to choose which template should load a page. WordPress creates a list of possible template filenames, and one of them comes directly from the pagename value in the URL without any proper validation.

The problem becomes clearer when you look at the code around it. Just above the vulnerable line, WordPress uses validate_file() to check another filename and block directory traversal. But the filename built from pagename completely skips that security check, even though it sits only three lines below the protected code.

Getting from that gap to something dangerous takes a bit of luck, but not much. The filename gets built as page-{$pagename}.php, so the attacker needs a theme with a folder starting with page-, which plenty of legacy and third-party themes still have. A urldecode() call earlier in the process is what turns an otherwise harmless-looking string into a working traversal path.

Reading an arbitrary file isn’t code execution on its own. It only runs whatever that file already does. The well-known trick is pulling in PEAR’s pearcmd.php, and that only fires if PHP has register_argc_argv switched on, a setting that happens to be the default in the official PHP Docker images and in cPanel setups running anything older than PHP 8.5.

“Including a local .php file is not by itself code execution of the attacker’s choosing. It runs whatever that file does. Getting from there to arbitrary code needs a readable .php file on the server that behaves usefully when included, and the well-known candidate is PEAR’s pearcmd.php, which only becomes useful when PHP is running with register_argc_argv enabled.” reads the report published by the cybersecurity firm PatchStack. “That setting is on by default in the official PHP Docker images and in cPanel environments on PHP below 8.5, so “unusual configuration” undersells how common it is.

So the honest framing is a conditional chain: unauthenticated file inclusion always, code execution when the host happens to line up.”

So the honest way to describe this bug is a chain, not a single click. File inclusion works everywhere, no exceptions. Code execution only fires when the server’s setup happens to line up, and a lot of servers do.

WordPress’s fix does two things, and the second one is the more telling of the two. The obvious patch runs the missing validate_file() check on the pagename branch, closing exactly the hole that got reported. The less obvious one adds a new function, _wp_is_template_path_allowed(), that every resolved template path now has to pass, no matter which code path produced it.

The second change is also worth noting. A one-line fix would have addressed the reported bug, but WordPress instead added a broader check across the template system. That suggests the security team wanted to make sure there were no other ways to reach the same problem.

If you cannot patch right away, two quick checks can help you understand your exposure. First, see if your active theme contains a folder starting with page-. Then check whether PHP has register_argc_argv enabled. Neither is a fix, but both can help show whether your site could be affected.

Updating is simple enough that there’s no good excuse left. It’s sitting in the Dashboard under Updates, or on WordPress.org directly, and every supported branch back to 4.7 already has its own backported fix waiting.

“Treat it as critical unless you have checked your own stack and know otherwise.” concludes Patchstack.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, WordPress)