[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1RvlpbJ7qs_AgJ8paTUtS9HfV-NU3IqkUuDR44cg3ss":3},{"article":4,"iocs":45,"watch_terms":50,"solutions":51,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":27},"31336276-ae66-4c6b-ab8e-dfd081f8f29d","CISA Adds One Known Exploited Vulnerability to Catalog","cisa-adds-one-known-exploited-vulnerability-to-catalog-f9b447","CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-88779 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.","CISA has added CVE-2026-88779, a vulnerability affecting Citrix NetScaler, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. This addition mandates federal agencies to prioritize its remediation under Binding Operational Directive (BOD) 26-04, which emphasizes risk-based vulnerability management for publicly exposed assets. CISA encourages all organizations to adopt similar practices.","CISA adds CVE-2026-88779, a Citrix NetScaler vulnerability, to its KEV Catalog.","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Falerts\u002F2026\u002F10\u002F04\u002Fcisa-adds-one-known-exploited-vulnerability-catalog",null,"2026-10-04T12:00:00+00:00","2026-10-04T20:00:18.727839+00:00",8,[17,20],{"name":18,"type":19},"Citrix NetScaler","product",{"name":21,"type":22},"Citrix","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":23,"icon":12,"name":25,"slug":26},"Vulnerabilities","vulnerabilities",[28,33,35,40],{"category":29},{"id":30,"icon":12,"name":31,"slug":32},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":34},{"id":23,"icon":12,"name":25,"slug":26},{"category":36},{"id":37,"icon":12,"name":38,"slug":39},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":41},{"id":42,"icon":12,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46],{"type":47,"value":48,"context":49},"cve","CVE-2026-88779","Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability",[21,18],{"controls":52,"vendors":135},[53,82,110],{"slug":54,"name":55,"problem":56,"products":57},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":83,"name":84,"problem":85,"products":86},"patch-management","Automated patch management","Known holes get closed in days, not months.",[87,94,102],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":83,"product_name":91,"url":92,"description":93},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":111,"name":112,"problem":113,"products":114},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[115,120,127],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":116,"product_name":117,"url":118,"description":119},"axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":122,"url":125,"description":126},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",[136],{"slug":137,"name":21,"logo_path":138,"roles":139},"citrix","\u002Fvendor-logos\u002Fcitrix.png",[140],"affected",{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":155},"citrix-netscaler-vulnerability-added-to-cisa-kev-catalog-amid-active-exploitation","Citrix NetScaler Vulnerability Added to CISA KEV Catalog Amid Active Exploitation","CVE-2026-88779 in Citrix NetScaler has been confirmed as actively exploited, prompting CISA to add it to the Known Exploited Vulnerabilities Catalog and mandate remediation for federal agencies under BOD 26-04. NetScaler is a widely deployed network gateway product, making it a high-value target for threat actors seeking initial access to enterprise environments. The active exploitation of this vulnerability underscores the danger of delayed patching on internet-facing infrastructure, where exposure windows are measured in hours, not days. Organizations that lack a risk-based vulnerability prioritization process are especially at risk of missing critical remediation deadlines for high-impact flaws like this one.",[146,147,148,149,150,151,152,153,154],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST CSF ID.RA-1: Asset vulnerabilities are identified and documented","NIST CSF RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","CISA BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities","ITIL 4: Problem Management – Proactive Problem Identification","ITIL 4: Change Enablement – Emergency Change Procedures",{}]