Small and rural healthcare providers lack the resources they need to make essential improvements to their information security programs to defend against cyberattacks. One of the biggest criticisms of the proposed update to the HIPAA Security Rule was the cost of implementation, especially for small, rural, and other underserved healthcare providers, who simply do not have the spare funds to make the required improvements or, in many cases, the staff to implement them.

While the proposed HIPAA Security Rule update attracted considerable criticism, a healthcare cybersecurity bill was unanimously passed by the Senate that calls for Congress to provide grants to underserved hospitals to help them make vital improvements to cybersecurity. The bill has been sent to the House; however, if it is passed and is signed into law by the President, Congress would need to approve the funding, so it could be many months before any grants are made available.

Some help may be on the way for rural hospitals in the meantime. On Monday, the White House Office for the National Cyber Director (ONCD) announced the Project Lifeline 250 initiative. Similar to the Project Watershed 250 project announced in Texas in late August to help state water and wastewater companies implement cybersecurity tools, Project Lifeline 250 is a pilot program to help rural hospitals make essential upgrades to cybersecurity, such as replacing vulnerable legacy systems that are easy targets for cybercriminals.

Project Lifeline 250 is a six-month pilot program that will provide free hardware upgrades and cybersecurity services to rural hospitals through partnerships with IT and cybersecurity companies such as Abnormal AI, Cisco, Cyera, Forescout Technologies, Infoblox Security Solutions, Microsoft, Palo Alto Networks, ServiceNow, Trelix, and Zscaler. Those companies have agreed to provide hardware and services to rural hospitals in South Carolina, allowing them to upgrade basic cybersecurity defenses free of charge. They include providing assistance with the identification and upgrading of vulnerable legacy technology, implementing AI-powered detection and response services, and providing backup drives to help the hospitals maintain critical services in the event of a cyberattack.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Similar to the Project Watershed 250 initiative, Project Lifeline 250 will be tested in a single state before a planned nationwide rollout. “Project Lifeline 250 connects the world-leading American industry with rural hospitals and uses the greatest American tools and capabilities to defend hospital networks; deploy physical backup devices after an initial incident to ensure an impacted hospital can still provide critical care; and identify high-risk and legacy devices and replace them,” said South Carolina Governor Henry McMaster, at the launch of the initiative at Newberry Health on Monday. While the announcement has been made, it was light on detail. It is unclear when the initiative will commence or how it will be funded if it is rolled out nationwide.

The post Government Initiative Provides Free Cybersecurity Upgrades and Security Services to Rural Hospitals appeared first on The HIPAA Journal.

Four vulnerabilities have been identified in HAPI FHIR, the open-source Java library and server framework that implements the HL7 FHIR standard, that affect Smile Digital Health’s Smile CDR clinical data repository and health data platform. The four vulnerabilities were identified by security researcher Abhinav Agarwal, who demonstrated that they can be exploited against HAPI FHIR 8.10.0, used by Smile CDR 2026.05.R01. According to Agarwal, exploitation of the vulnerabilities can allow cross-tenant data access and modification, unauthorized patient record disclosure, clinical data leakage, and unauthenticated service disruption.

HAPI FHIR is a widely used open source software component and is not exclusively used by Smile Digital Health’s CDR platform; however, Smile Digital Health maintains the HAPI FHIR project. The component is free to use and has been incorporated into many healthcare products, and for healthcare providers, determining which are at risk could be challenging. According to Agarwal, he identified eight other commercial products that use HAPI FHIR. At the time of the announcement, there has been no known exploitation of the flaws.

The vulnerabilities are:

• CVE-2026-113873: Improper handling of highly compressed data – High severity. An unauthenticated attacker could send compressed payloads that could exhaust the server heap or crash services when decompressed. The vulnerability has a CVSS v3.1 base score of 7.5 and a v4.0 base score of 8.7.
• CVE-2026-113874: Incorrect authorization – High severity. The SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition previously established by a trusted source. Storage partition entitlement is not enforced by default. Successful exploitation of the vulnerability can allow an attacker authorized for one tenant to read and write data in another tenant’s partition. The vulnerability has a CVSS v3.1 base score of 8.1 and a CVSS v4.0 base score of 8.6.
• CVE-2026-113876: Unauthorized read access – Medium severity. Smile CDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE, but not READ, permissions could submit a conditional create whose predicate matches an existing resource and receive the target resource’s contents. The vulnerability has a CVSS v3.1 base score of 5.3 and a CVSS v4.0 base score of 5.3.
• CVE-2026-113875: Missing authorization – Low severity. The vulnerability affects the Smile CDR HAPI FHIR server with REST-hook subscriptions enabled. If a user is granted subscription-creation permissions, they could query and read full clinical resources outside their authorized read scope at a specified endpoint, including future matching records. The vulnerability has a CVSS v3.1 base score of 3.1, and a CVSS v4.0 base score of 2.3.

The flaws in the HAPI FHIR open source engine utilized by the Smile CDR health data platform could impact more than 30 US payer deployments that involve the health data of more than 110 million individuals in the United States. Smile Digital Health has confirmed that CVE-2026-113873 will be fixed in its November release, and CVE-2026-113874 can only be exploited by an authenticated user who is authorized to access at least one partition, so the potential for exploitation is limited.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

The post Multiple Vulnerabilities Identified in Component Used by Smile Digital Health’s Smile CDR appeared first on The HIPAA Journal.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Secret Service (USSS), and cybersecurity agencies in Germany and the United Kingdom have issued a joint cybersecurity advisory about the SafePay ransomware group.

SafePay is a financially motivated threat group that has been in operation since August 2024 and targets businesses and critical infrastructure entities in North and South America, Europe, and Australia. The group engages in double extortion tactics, exfiltrating data, encrypting files with ransomware, and issuing ransom demands, payment of which is required to unlock files and prevent stolen data from being leaked online.

Just two months after the group was first identified, it attacked the U.S. business service provider Conduent Business Services and exfiltrated 8.5 terabytes of data. Conduent reported the incident as affecting 62.2 million individuals. The incident ranks as the third-largest U.S. healthcare data breach of all time. The group has accelerated attacks and is now one of the most prolific ransomware groups, having attacked more than 600 entities from multiple critical infrastructure sectors.

The security advisory includes the latest tactics, techniques, and procedures (TTPs) observed by the authoring agencies and security researchers. SafePay actors use a variety of techniques for initial access, including brute force password attacks, credential exposure, and vulnerability exploitation for edge devices, including the Cisco Adaptive Security Appliance vulnerabilities CVE-2023-20269 and CVE-2020-3259; the Veeam Backup & Replication vulnerabilities CVE-2023-27532 & CVE-2024-40711; and the SonicWall SonicOS vulnerability CVE-2024-40766. VPNs are also targeted, especially the Mullvad VPN provider, using phished account profiles.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Once networks are compromised, SafePay actors take over existing accounts or create new ones and use legitimate system tools for credential theft, network scanning, lateral movement, and data exfiltration. Valuable files are identified and exfiltrated, security protections are disabled, files are encrypted, and ransom notes are dropped.

The authorizing agencies recommend regularly patching and updating systems, prioritizing patches for the above-mentioned vulnerabilities and other known exploited vulnerabilities (KEVs). Administrative tools and privileges should be restricted, and the Zero Trust Principle should be implemented. Account security should be strengthened by implementing identity, credential, and access management (ICAM) policies and multifactor authentication. Indicators of Compromise (IoCs), detailed TTPs, and further recommendations are detailed in the security advisory.

The post Feds Issues Advisory About SafePay Ransomware Group appeared first on The HIPAA Journal.

Cyberattacks on healthcare organizations are continuing to rise, are becoming costlier to resolve, and are increasingly negatively impacting patient care, according to a recent survey conducted on behalf of the cybersecurity firm Proofpoint. The findings were published in the 2026 Ponemon Healthcare Cybersecurity Report.

The survey was conducted by the Ponemon Institute and included 705 responses from IT and IT security practitioners whose responsibilities include setting cybersecurity policies, selecting vendors and contractors, and managing security budgets. The respondents included public healthcare providers (22%), private healthcare providers (18%), healthcare insurers (18%), payers (11%), healthcare insurance companies (10%), with the remainder from life sciences, pharma, and biotechnology companies.

According to the survey, 97% of organizations experienced at least one cyberattack in the past 12 months, with an average of 51 attacks per organization, up from 43 attacks this time last year. In 74% of incidents, the incidents had a negative impact on patient care. The report was focused on four categories of cyberattack: cloud/account compromises, business email compromise, ransomware attacks, and supply chain attacks. Supply chain attacks had the greatest impact on patient care, with 90% of respondents affected by a supply chain attack reporting that it impacted patient care, followed by ransomware attacks (72%), business email compromise incidents (69%), and cloud/account compromises (65%).

Sixty-eight percent of respondents said business email compromise attacks resulted in delays to procedures and tests, 70% of respondents said ransomware attacks resulted in longer patient stays, 59% of respondents said cloud/account compromises resulted in an increase in complications from medical procedures, and 35% of respondents said supply chain attacks resulted in an increased mortality rate.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

These attacks are costly for healthcare organizations. Respondents were asked about the cost of the most expensive cyberattack at their organization in the past 12 months. The average cost of the most expensive attack was $4.2 million, up from $3.9 million in 2025. The most expensive element was disruption to business operations, which cost an average of $1.39 million per incident, up from $1.2 million in 2025.

The survey revealed that healthcare organizations are embracing AI tools, with 45% of respondents confirming that they have embedded AI, 24% in cybersecurity operations and 21% in cybersecurity and patient care; however, utilization often exceeds the ability to govern and secure those tools and platforms. Sixty percent of respondents said that they lacked sufficient controls governing the sensitive data used in AI systems, and while security measures had been implemented, 42% said those measures had not been developed for use with AI platforms. Only one-third (32%) of respondents said they have full visibility into the usage of AI tools within their organization. The biggest perceived AI-specific risks were supply chain risk from AI vendors (40%), data leakage through prompts (36%), AI-generated phishing/social engineering attempts (34%), and malicious or biased outputs that affect care decisions (32%).

While hacking incidents continue to increase, insider risk continues to be a problem in healthcare, with 97% of organizations experiencing at least two data loss or exfiltration incidents in the past 12 months, with an average of 21 incidents at each organization. More than half of respondents (54%) said these incidents impacted patient care, and 56% of respondents said these insider incidents resulted in an increase in mortality rates.

“Cybersecurity incidents are increasingly disrupting clinical operations, consuming organizational resources, and affecting care delivery,” explained Proofpoint.  “The healthcare organizations that will be most successful in the years ahead will be those that combine cyber resilience, identity security, human risk management, supply chain security, and AI governance into a unified strategy focused on protecting both operations and patient outcomes.”

The post Healthcare Cyberattacks Increasing and Having Greater Impact on Patient Care appeared first on The HIPAA Journal.

The tactics of ransomware groups are constantly changing to increase pressure on victims to give in to their demands. Initially, file encryption alone was sufficient; however, as victims improved cyber resilience and were able to recover their encrypted files from backups, tactics had to evolve. Ransomware groups incorporated data theft into their attacks and started threatening to sell or leak the stolen data if the ransom was paid. This double extortion approach proved highly successful, with the threat of a data leak alone sufficient to prompt many victims to pay up.

Encryption and data leak threats are no longer enough, as the percentage of victims paying ransoms continues to fall. According to a recent survey commissioned by the Identity Threat Detection and Response (ITDR) firm Semperis, the percentage of ransomware victims paying ransoms has fallen from 78% in 2024 to 69% in 2025, and 59% in 2026.

Ransomware groups have responded by adopting more aggressive tactics, and a trend has emerged of ransomware groups issuing personal threats against company employees and their friends and family members. The survey revealed that 37% of ransomware attacks involved threats against friends or family members of staff members, and 41% of respondents to the survey said they had been a target of physical or psychological intimidation.

While contacting individuals whose data was stolen in an attack has been adopted by several groups in the past, the threats have generally been limited to the publication of personal data, but threats are becoming more severe. Ransomware groups are now issuing threats of physical violence and are contacting employees and their friends and family members via text, email, or phone, confirming that they know where they live, work, and even where their children go to school.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

The threat of data erasure, destruction, and publication remains the most common tactic (56%), followed by blackmail/extortion (41%), and system lockouts or sabotage (40%); however, 23% of malicious actors have resorted to psychological intimidation, 17% are issuing physical threats, and in 10% of cases, have threatened legal exposure. Semperis warns in its third annual ransomware report that personal threats are gaining more traction. Out of the individuals who received personal threats, 57% received threatening texts, letters, or packages, 37% received threats about friends and family members, 19% were threatened with physical intrusion, 17% with abduction, 13% with bodily harm, and 6% with stalking.

Semperis said that in 53% of cases, the attackers followed through on their threats. There have been cases of doxxing – exposing personal information – and swatting – triggering an armed police response to a reported threat – which can push victims into ransom negotiations. About 25% of victims reported doxxing, and 23% experienced swatting, according to the survey.

The impact on the individuals concerned has been severe, with around a quarter of the targeted individuals requiring medical or mental health care, and 14% stating they have been forced to change jobs, offices, or homes as a result. Semperis suggests that companies need to respond to these modern threat tactics and should incorporate procedures into their ransomware resilience strategies, including how to respond to attacks involving threats to individuals outside of the organization.

“I’ve spoken with CISOs that had strong relationships with law enforcement,” said Courtney Guss, AVP of Crisis Management, Semperis. “They’ve found it to be a much faster route to information and resources than they would otherwise have found on their own, which can often help them recover more quickly. So, knowing those contacts and building those relationships in advance should be part of your crisis management plan.” Semperis also recommends strengthening identity resilience, preparing for identity system breaches, and practicing incident response procedures time and again against realistic scenarios, including tabletop exercises involving all team members involved in the ransomware response.

The post Ransomware Groups Increasingly Resorting to Real World Threats appeared first on The HIPAA Journal.

A high-severity authentication bypass vulnerability has been identified in the Ivanti Connect Secure (Pulse Connect Secure) enterprise-grade SSL VPN that can allow a remote, unauthenticated malicious actor to execute arbitrary commands, steal credentials, and exfiltrate sensitive data.

Researchers at the cybersecurity firm Volexity identified in-the-wild exploitation of a vulnerability chain involving the authentication bypass vulnerability in the first week of October. The threat actor was able to compromise a fully patched ICS VPN appliance and achieve remote, root-level code execution. The vulnerability has been exploited by malicious actors on limited ICS customers and has been added to CISA’s Known Exploited Vulnerability (KEV) Catalog.

Volexity determined that the threat actor exploited three zero-day vulnerabilities in the attack, including the authentication bypass vulnerability and a remote code execution vulnerability, which are jointly tracked as CVE-2026-104935. The vulnerability has a CVSS v3.1 base score of 8.6. Ivanti says the vulnerability has been exploited by malicious actors onlimited ICS customers, and has been added to CISA’s Known Exploited Vulnerability (KEV) Catalog. The third zero-day is a privilege escalation vulnerability, which has yet to be patched. Ivanti is working on a patch to fix that flaw, which will be addressed in a future release.

The CVE-2026-104935 vulnerability affects the following Ivanti Connect Secure (ICS) versions, and patches have been released to fix the flaws. Customers are also advised to run the Integrity Checker Tool regularly.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Limited indicators of compromise have been identified by Volexity and are detailed in its blog post.

The post Ivanti Connect Secure Zero Day Exploited in Attacks appeared first on The HIPAA Journal.

An analysis of medical devices indicates that healthcare organizations face a significant risk of future quantum-enabled attacks, as only a small percentage are capable of supporting a transition to post-quantum cryptography (PQC). The analysis was conducted by cybersecurity firm Forescout on more than 2.5 million Internet of Medical Things (IoMT) devices used by more than 50 healthcare delivery organizations. The findings are published in its October 2026 PQC in Healthcare Report.

Quantum computers vastly surpass the computational ability of standard computers as they process information using quantum states. They are capable of tackling complex problems that even today’s supercomputers are unable to solve. A problem tackled by a quantum computer may take minutes or hours compared to millennia by today’s most powerful computers. One such application would be cracking today’s encryption models.

Quantum computers are still under development, but Google has predicted that advances currently being made could render current encryption methods obsolete in the next five years, potentially as early as 2029. While it may appear that there is no immediate risk, encrypted data could potentially be harvested now for decryption later when quantum computing has sufficiently advanced. Forescout warns that the risk is greater in healthcare due to the long-term value of healthcare data, compared to data such as account numbers and payment card information which can be easily changed.

According to the analysis, only 6% of IoMT devices and 16% of operational technology (OT) devices use SSH implementations that support PQC. These devices are relied on by healthcare organizations for a range of functions; however, the lowest percentage of IoMT devices capable of supporting PQC are those used for providing patient care. By comparison, around 50% of IT devices are capable of supporting PQC.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

PQC involves the use of new cryptographic algorithms capable of protecting against attacks from quantum computers; however, healthcare is particularly exposed because many medical devices in use are not capable of supporting PQC, including systems and devices that contain large volumes of highly sensitive healthcare data such as electronic medical records (EMRs), Picture Archiving and Communications Systems (PACS), and devices used for patient care such as patient monitors, imaging systems, infusion pumps, and lab equipment.

These systems and devices tend to have long lifecycles; however, they also have limited paths for upgrading, including upgrades to support new cryptographic standards. Many of these devices and systems are also exposed to the Internet, which makes them vulnerable to attack. The researchers identified 5,500 Internet-exposed systems, including EMRs and PACS. Overall, out of all exposed medical information systems, only 31% supported TLS 1.3 – the only TLS version capable of supporting standardized PDC. The analysis found that 6% of PACS supported TLS 1.3, falling to 33% for EMRs, and 13% for laboratory management systems.

The key to protecting data against quantum-enabled attacks is preparation. “PQC migration is not simply an encryption upgrade project,” said Daniel dos Santos, VP of Research at Forescout. “Healthcare providers need to understand which assets store, process, and transport their most sensitive data, which systems can realistically be upgraded, and where compensating controls will be required. Our research shows that the devices least prepared for the transition are often the same devices healthcare organizations depend on most for delivering patient care. Visibility into those assets and the data they handle is essential for building a practical migration strategy.”

Forescout recommends that healthcare organizations start preparing now by creating a comprehensive and accurate inventory of all systems and devices, including IT, OT, IoT, and IoMT devices, along with data types and connections, prioritizing internet-exposed connections. All assets should be assessed to determine if they are capable of supporting PQC, and any assets that are not should be prioritized for upgrades or compensating controls, especially Internet-exposed connections such as patient portals, external-facing APIs, VPN gateways, and inter-organization data exchange. TLS 1.3 should be enforced, where possible. Any systems that cannot be upgraded should be segmented and isolated, and PDQ readiness should be incorporated into governance, procurement, and risk management processes. ForeScout also recommends ensuring that vendors understand PQC roadmaps if they have not offered alternatives, as well as timelines for migration to PQC.

The post Many Medical Devices Incapable of Supporting Transition to Post-Quantum Cryptography appeared first on The HIPAA Journal.

Citrix has released another patch for a zero day vulnerability under active exploitation, just a few days after patches were released for two other actively exploited zero day flaws. Like the previous two zero day flaws, the latest vulnerability affects Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway appliances. The former is often used to provide cloud applications to employees, while the latter is commonly used as an SSL VPN to provide single sign-on to remote workers.

The previously patched two zero-days can lead to remote code execution; however, the latest vulnerability is believed to only allow an attacker to crash the system, with repeated attacks resulting in denial of service. Citrix explained that it has observed targeted attacks on unmitigated NetScaler systems and has yet to determine the impact on the integrity of customer data. Security researchers have found evidence that threat actors are chaining one of the earlier RCE zero day flaws – CVE-2026-8877 – with the latest vulnerability.

The vulnerability is tracked as CVE-2026-88779 and is rated high severity, with a CVSS v4.0 severity score of 8.7. The flaw is a memory overflow vulnerability in SAML that affects customer-managed deployments configured as a SAML Service Provider (SAML SP / SAML IdP). Citrix also warned that Secure Private Access Hybrid deployments using NetScaler instances are also affected by the vulnerability. Citrix-managed cloud services and Citrix-managed Adaptive Authentication have been automatically updated with the fixed version.

Patches to fix the vulnerability were issued on October 4, 2026. Users who have already patched the previous two zero days will also need to apply the latest fix to protect against exploitation. Citrix is urging all customers with vulnerable appliances to upgrade to the fixed version as soon as possible. Further information can be found in the Citrix security bulletin.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Vulnerable versions:

• Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1 prior to 14.1-73.41
• Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1 prior to 13.1-64.28
• Citrix NetScaler ADC FIPS prior to 14.1-73.41 FIPS
• Citrix NetScaler ADC FIPS and NDcPP prior to 13.1-37.282

Patched versions:

• NetScaler ADC / NetScaler Gateway versions 14.1-73.41 and later 14.1 releases
• NetScaler ADC / NetScaler Gateway versions 13.1-64.28 and later 13.1 releases
• NetScaler ADC 14.1-FIPS 14.1-73.41 FIPS and later 14.1-FIPS releases
• NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.282 and later 13.1-FIPS and 13.1-NDcPP releases

The post Citrix Patches Third Actively Exploited NetScaler Zero Day appeared first on The HIPAA Journal.

Two critical zero-day vulnerabilities in Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) are under active exploitation and require immediate patching. The vulnerabilities are part of a batch of eight flaws detailed in a Citrix security bulletin issued on September 27, 2026. Six of the vulnerabilities are rated high severity, with CVSS v4.0 severity scores between 7.0 and 8.8. The critical flaws have a CVSS base score of 9.5.

• CVE-2026-88771 is a critical remote code execution vulnerability due to improper input validation. Successful exploitation can allow an attacker to execute arbitrary commands. The vulnerability affects all Citrix NetScaler ADC and Citrix NetScaler Gateway deployments.
• CVE-2026-88772 is a critical memory overflow vulnerability that can lead to remote code execution or denial of service. The vulnerability is present if DTLS configuration is enabled on NetScaler ADC or NetScaler Gateway. It is enabled by default on VPN vServer.

The six remaining vulnerabilities are as follows:

• CVE-2026-88775; CVE-2026-88776 & CVE-2026-88777 – (CVSS 8.8) – Memory overflow vulnerabilities leading to unpredictable or erroneous behavior or denial of service.
• CVE-2026-88778 (CVSS 8.8) – TCP Initial Sequence Number (ISN) prediction flaw.
• CVE-2026-88774 (CVSS 7.0) – Feature policy bypass (improper HTTP URL-based expression usage).

The vulnerabilities affect the following Citrix NetScaler ADC and Citrix NetScaler Gateway versions:

• Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1 BEFORE 14.1-73.37
• Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1 BEFORE 13.1-64.23
• Citrix NetScaler ADC FIPS BEFORE 14.1-73.37 FIPS
• Citrix NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.279

Software updates have already been applied to fix the vulnerabilities in Citrix-managed cloud services and Citrix-managed Adaptive Authentication. Patches need to be applied to fix the vulnerabilities in customer-managed Citrix NetScaler ADC and Citrix NetScaler Gateway deployments. Since two of the vulnerabilities are under active exploitation, customers are urged to upgrade as soon as possible. The extent to which the flaws are being exploited has not been disclosed.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

The updated versions with the vulnerabilities fixed are:

• Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1-73.37 and later releases
• Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1-64.23 and later releases of 13.1
• Citrix NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS and later releases of 14.1-FIPS
• Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.279 and later releases of 13.1-FIPS and 13.1-NDcPP

The post Citrix Patches Actively Exploited NetScaler ADC & NetScaler Gateway Vulnerabilities appeared first on The HIPAA Journal.