Citrix NetScaler Exploited: CISA Set a 29 August Fix

Three things worth an hour of your week if you run a small business network. A Citrix flaw that the vendor played down is now being used to plant web shells, CISA’s latest batch of actively exploited bugs is mostly a decade old, and two self-hosted tools that small firms quietly depend on were added to the same list days earlier.

A Citrix bug labelled a crash risk is being used for remote code execution

Citrix patched CVE-2026-8452 on 30 June. Its own advisory calls it a high-severity memory overflow that can cause unpredictable behaviour and denial of service, which reads like a stability problem rather than a break-in. On 14 August the security firm watchTowr published analysis and proof-of-concept code showing the same flaw can be exploited for unauthenticated remote code execution. Exploitation in the wild followed shortly after, with attackers dropping a web shell and running discovery commands such as id and echo.

CISA added the CVE to its Known Exploited Vulnerabilities catalog on 26 August and told federal agencies to fix it by 29 August. A three-day deadline is unusual and tells you how seriously it is being taken. The flaw is only exploitable where the appliance is configured as an AAA virtual server or a Gateway VPN server, which is to say, where it is doing remote access. Versions 14.1-72.61 (FIPS), 13.1-63.18 and 13.1-37.272 carry the fix. At the time of writing Citrix had not updated its advisory to confirm exploitation.

Two months between a patch and mass exploitation is a normal interval, and it is exactly the window insurers ask about. Most cyber policies do not say “you must patch in 14 days” in the wording, but they do ask you to take reasonable care, and a proposal form you filled in saying you patch promptly becomes a live question at claim time. If you have a NetScaler doing VPN or SSO for staff, treat this as an emergency, not a maintenance ticket. Our guide to what cyber insurance covers and where the exclusions sit explains where that argument usually lands. Full detail is at SecurityWeek.

Five of the six bugs CISA added on 26 August predate 2023

The same 26 August alert added six vulnerabilities in total, and the age spread is the story:

• CVE-2015-3246, a race condition in Red Hat’s libuser
• CVE-2015-5287, privilege escalation in Red Hat’s Automatic Bug Reporting Tool
• CVE-2019-1068, remote code execution in Microsoft SQL Server
• CVE-2021-23758, deserialisation of untrusted data in Ajax.NET Professional
• CVE-2022-0995, an out-of-bounds write in the Linux kernel
• CVE-2026-8452, the Citrix flaw above

Two of them are eleven years old. Attackers are not spending their time on novel research when an unpatched 2015 Linux box is sitting there. This is the practical case for asset inventory before tooling: you cannot patch a server you forgot you had, and the machines that never get rebooted are the ones running the old kernel. Cyber Essentials requires you to apply critical and high-severity updates within 14 days of release, and the honest failure mode for most small firms is not missing this month’s patches, it is a forgotten VM from four years ago. The alert is at CISA.

Gitea and TrueConf joined the list earlier in the same week

On 25 August CISA added CVE-2026-60004, a code injection flaw in Gitea, the self-hosted Git service a lot of small development teams run instead of paying for GitHub. On 20 August it added two flaws in TrueConf Server: CVE-2026-72529, missing authentication for a critical function, and CVE-2026-72530, code injection.

Both are the same shape of risk. They are internal tools, installed once by someone technical, exposed to the internet so people can reach them from home, and then never thought about again. Nobody owns the patching because nobody remembers the box exists. If you run either, patch now and then write down who is responsible for it. Our cyber security checklist for businesses covers how to build that list without buying anything. The alerts are at CISA for Gitea and TrueConf.