Today's outlook

CISA lists an actively exploited Citrix NetScaler flaw that crashes appliances — patch now

By The IT Security Desk

Good morning. Help Net Security reports that CISA added CVE-2026-88779 to its Known Exploited Vulnerabilities catalog on Sunday, describing it as a memory overflow bug that may cripple vulnerable NetScaler ADCs and Gateways. Help Net Security quotes Citrix: "Citrix has observed targeted attacks on unmitigated NetScaler deployments which can lead to Denial of Service." The Register reports that the flaw is a memory overflow bug that leads to denial of service. The advisory record carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) — availability impact only, consistent with the denial-of-service effect both outlets describe. Affected: NetScaler ADC 13.1 up to the fix in 13.1-37.282. Because it is on the KEV catalog, CISA's remediation requires applying mitigations in accordance with vendor instructions and BOD 26-04 guidance, or discontinuing use of the product if mitigations are unavailable. Upgrade to the fixed release 13.1-37.282 per the Citrix advisory, and treat exposed, unmitigated appliances as a priority.

Separately, The Record reports that the US and Australia issued warnings over a newly observed NetScaler issue, which Citrix confirmed late on Friday affects some customer-managed deployments; Citrix said this issue is not connected to the vulnerabilities reported the previous week.

Elsewhere on Monday: The Hacker News reports that Microsoft released out-of-band security updates for a high-severity flaw in Microsoft Exchange Server that could allow an attacker to escalate privileges under certain conditions, which it attributes to weak authorization in Exchange. Match your Exchange build against Microsoft's advisory and apply the out-of-band update.

BleepingComputer reports that hackers are actively scanning for a critical Rejetto HFS weak signing key vulnerability that allows session forgery, account takeover and remote code execution. The Register reports that Debian's latest kernel security update carries 1,313 fixes, and attributes the sprawling tally in part to broad CVE rules, with AI-assisted bug hunting adding to maintainers' workload.

On breaches and arrests: BleepingComputer reports that Denmark's Central Population Register warned of a data breach exposing the personal information of approximately 8.8 million registered individuals. The Record reports that a ransomware attack on the University of Illinois Chicago College of Medicine resulted in the theft of information from its servers, and that Ukraine's largest grocery chain, ATB, confirmed a cyberattack after hackers posted an extortion demand. The Record reports that an alleged ShinyHunters member, Saif al-Din Khader, was detained in Jordan and is cooperating with the FBI; The Register reports the FBI confirmed multiple arrests related to the ShinyHunters hack.