CISA Flags Six Actively Exploited Bugs, Including a Citrix NetScaler Flaw

Key points - The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added six security flaws to its Known Exploited Vulnerabilities catalog on Wednesday. - The list includes a high-severity bug in Citrix NetScaler ADC and NetScaler Gateway, widely used to log staff into corporate networks. - Other flaws affect the Linux kernel and Microsoft SQL Server, with at least one dating back to 2019. - Federal civilian agencies have three weeks to patch or stop using the affected products. - CISA says all six flaws have been seen in real attacks, not just proof-of-concept demos.

CISA, short for the Cybersecurity and Infrastructure Security Agency, keeps a public list called the Known Exploited Vulnerabilities catalog: a most-wanted list for software bugs that federal agencies must act on fast.

Six new entries went on the list Wednesday. The one grabbing attention sits inside Citrix NetScaler ADC and NetScaler Gateway, the gear many large employers use to let staff sign in to work systems remotely. When a bug lives at the front door of the network, attackers who get through can often reach a great deal of what is behind it.

For identity teams, NetScaler's position matters. It frequently sits in front of single sign-on (the system that lets one login open many apps). Compromise the gateway and multi-factor authentication, that second step like a code from your phone, can be sidestepped entirely, because the attacker never touches the login page itself. We've tracked Citrix NetScaler since our first story on 6 July; this is the third time it's appeared in our coverage.

What are the six flaws?

All six are being actively exploited, meaning real attackers, not researchers, are using them. One dates to 2019, which says something uncomfortable about how long unpatched kit lingers in production.

The bugs span three very different products: a network gateway, an operating system core, and a database server.

A remote code execution flaw lets an attacker run their own commands on a machine from far away. A privilege escalation flaw lets someone who's already got a foothold promote themselves to administrator. Together they're the standard recipe for a serious breach.

Who has to act, and how quickly?

Every federal civilian agency in the United States has roughly three weeks to apply vendor patches or stop using the affected products.

Private companies aren't legally bound by that deadline. CISA's list has quietly become the industry's shorthand for what to fix first, though, because a bug being used against the federal government tends to show up against everyone else shortly after. Our 26 August story on CISA's breach review found exactly that pattern: attackers scan for known, exposed flaws that organisations never got around to fixing.

Should ordinary people worry?

Not directly, but indirectly, yes. You won't patch a NetScaler at home. Your bank or your employer might run one.

If your workplace uses Citrix to log in remotely, expect a forced sign-out or a maintenance window soon. That's a good sign. It usually means the fix is going in.

For personal accounts, the familiar advice still holds: turn on multi-factor authentication where you can. For the gateway bug specifically, MFA wouldn't have blocked these attacks reliably, because the flaw bypasses the login flow before authentication ever runs. That's precisely why patching the gateway matters more than any user-side control.

Citrix and Microsoft have both published fixes. Administrators should check vendor advisories directly and confirm the patched build number before closing the ticket.