CISA Orders Federal Agencies to Patch Actively Exploited Citrix NetScaler RCE by Saturday

CISA has ordered U.S. federal agencies to patch Citrix NetScaler appliances against a remote code execution vulnerability, tracked as CVE-2026-8452, by Saturday. The flaw is under active exploitation, according to CISA and confirmed separately by SecurityWeek.

Any organization running NetScaler ADC or Gateway should prioritize patching regardless of the federal deadline, given confirmed in-the-wild attacks.