CISA Flags Six Actively Exploited Bugs, Including a Citrix NetScaler Flaw

Key points

• The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added six security flaws to its Known Exploited Vulnerabilities catalog on Wednesday.
• The list includes a high-severity bug in Citrix NetScaler ADC and NetScaler Gateway, widely used to log staff into corporate networks.
• Other flaws affect the Linux kernel and Microsoft SQL Server, some dating back to 2019.
• Federal civilian agencies have three weeks to patch or stop using the affected products.
• CISA says all six flaws have been seen in real attacks, not just proof-of-concept demos.

The U.S. government's cyber agency has told federal staff to urgently fix six software flaws that criminals are already using to break into networks.

CISA, short for the Cybersecurity and Infrastructure Security Agency, keeps a public list called the Known Exploited Vulnerabilities catalog. Think of it as a most-wanted list for software bugs. If a flaw is on it, agencies have to patch fast.

On Wednesday, six new entries went on the list. The one grabbing attention sits inside Citrix NetScaler ADC and NetScaler Gateway, the gear many large employers use to let staff sign in to work systems from home. When a bug lives in the front door of the network, attackers who get through can often reach a lot of what is behind it.

This matters for identity teams like mine. NetScaler frequently sits in front of single sign-on, the system that lets one login unlock many apps. Break the gateway and multi-factor authentication (the second step, like a code from your phone) can be sidestepped entirely, because the attacker never touches the login page.

What are the six flaws?

All six are bugs CISA says are being actively exploited, meaning real attackers, not researchers, are using them. The oldest goes back to 2019, which tells you how long unpatched kit lingers in the real world.

The Hacker News, which first published the full list, noted the bugs span three very different products: a network gateway, an operating system core, and a database server.

A remote code execution flaw means an attacker can run their own commands on the machine from far away. A privilege escalation flaw means someone who already has a foothold can promote themselves to administrator. Both are the ingredients of a serious break-in.

Who has to act, and how quickly?

Under a binding order called BOD 22-01, every federal civilian agency in the United States has roughly three weeks to apply the vendor patches or stop using the affected products.

Private companies are not legally bound by that deadline. But CISA's list has quietly become the industry's cheat sheet for what to patch first, because if a bug is being used against the U.S. government, it will be used against everyone else too.

Should ordinary people worry?

Not directly, but indirectly, yes. You will not patch a NetScaler at home. Your bank, your hospital and your employer might run one.

A sensible move this week: if your workplace uses Citrix to log in remotely, expect a forced sign-out or a maintenance window. That is a good thing. It usually means the fix is going in.

For personal accounts, the boring advice still holds. Turn on multi-factor authentication where you can. Would MFA have blocked these particular attacks? Honestly, for the gateway bug, not reliably, because the flaw bypasses the login flow itself. That is exactly why patching the gateway matters more than any user-side control.

Citrix and Microsoft have both published fixes. Administrators should check vendor advisories directly and confirm the patched build number before ticking the job off.