Issue #2: Identity Gateways Under Fire, Funding on a Clock (October 5, 2026)

The Signal

Three developments from September 27 through October 4 will reach delivery teams before they reach most roadmaps.

Key dates: October 7, CISA's federal deadline for CVE-2026-88779. November 16, North Carolina Rural Health Innovation Fund applications close. December 11, the continuing resolution expires.

1. Identity infrastructure is being exploited again, this time in Citrix NetScaler. On September 27, CISA amplified Citrix's disclosure of eight new vulnerabilities in NetScaler ADC and NetScaler Gateway. Two of them, CVE-2026-88771 and CVE-2026-88772, were exploited as zero-days, and CISA says each can independently enable remote code execution. On October 4, CISA added a third, CVE-2026-88779, to its Known Exploited Vulnerabilities (KEV) catalog with an October 7 deadline for federal civilian agencies, three days later. Citrix's bulletin describes it as a memory overflow that leads to denial of service on appliances configured as a SAML service provider or identity provider. Researchers are investigating whether it can go further; Citrix has not said so. The fixed builds are 14.1-73.41 and 13.1-64.28 or later, so teams that updated for the September 27 batch should check their builds again.

2. Updated FHIR standards for prior authorization and payer-provider data exchange took effect October 1. In the FY2027 Inpatient Prospective Payment System (IPPS) final rule (CMS-1849-F), ONC, the Office of the National Coordinator for Health IT, adopted updated HL7 FHIR implementation guide versions for electronic prior authorization, payer-provider clinical and administrative data exchange, drug formularies, and provider directories. Where ONC adopted an earlier version in the HTI-4 rule, the new version replaces it. For electronic prior authorization, the updated Coverage Requirements Discovery, Documentation Templates and Rules, and Prior Authorization Support guides are now the only versions developers may use to meet ONC's certification criteria.

3. FY2027 began under a continuing resolution, and the money that is moving carries conditions. The Continuing Appropriations Act, 2027 (P.L. 119-103), signed September 2, funds agencies at FY2026 levels through December 11. For Defense, Section 102 bars new starts, higher production rates, and certain multiyear procurements. NIH's September 28 notice says institutes may issue noncompeting awards below the indicated level, with increases considered only after full-year appropriations. Meanwhile, CMS Rural Health Transformation Program money is reaching states in different forms. On October 2, CMS announced $7.2 million for 25 South Dakota emergency medical services projects. North Carolina's Rural Health Innovation Fund, launched September 30 at about $20 million a year for up to five years, is still taking applications until November 16, with awards expected in January 2027.

Why It Matters

None of these looks like a delivery story in the headline. Each one becomes delivery work.

NetScaler is where login happens. When an appliance acts as a SAML identity or service provider, a denial-of-service flaw is an authentication outage: nobody signs in to the applications behind it. The remote-code-execution zero-days are worse. CISA's alert notes that updating these appliances can be complex and may require downtime, so “patch now” competes with release windows and change freezes, and a change window closed for the September 27 fixes may have to reopen. BOD 26-04 binds only federal civilian agencies, but a three-day clock is the pace attackers set for everyone. Issue #1 covered F5 BIG-IP APM and WSO2. NetScaler makes it a pattern.

A new version of a standard is a migration, not an announcement. Moving between implementation guide versions can change data elements, error handling, and test expectations, and both sides of an exchange have to move together. Adopting a standard in ONC's certification program is not, by itself, a new deployment deadline for every payer or provider API. It does change what certified products must support and what partners will expect to test against. A team-level “API complete” milestone will not prove an exchange works end to end.

Funding with conditions changes how plans should be written. Under the continuing resolution, anything that depends on a new start is not committed until a full-year appropriation or explicit funding confirmation arrives. North Carolina shows another pattern: money that exists but has not been awarded, followed by a short build window. First-round awards in January and a July 30, 2027 completion date leave roughly six months, and because the funding is reimbursement-based, providers carry costs first. South Dakota shows the integration test. An ambulance-to-hospital handoff needs connectivity, patient identification, data permissions, and uptime to all work in the field, with training and support in the baseline.

Delivery Impact

The same three signals land differently depending on who is accountable for the work.

Audience	Identity gateways (NetScaler)	FHIR standard versions (Oct. 1)	Funding on a clock
Project and Scrum leaders	Confirm which appliances run SAML and which versions are deployed. Run an expedite lane: exposure, update, compromise review, SSO failover test, closure evidence.	Make conformance testing and version migration explicit features with acceptance evidence, not a line inside an interface backlog.	Tag every work item as funded continuation, dependent on a new start, or awaiting an award. Do not commit sprint capacity to the last two.
Program and portfolio leaders	Inventory every NetScaler by owner and treat single sign-on as a shared dependency in the portfolio risk register. Plan update windows, because downtime may be required.	List adopted versus contracted versus partner versions for each exchange, and name the owner of each migration decision.	Separate funded continuation from proposed scope in roadmaps, staffing plans, subcontract commitments, and forecasts. Get contracting or grants officer confirmation for a specific program before changing its baseline.
Executives	Ask what stops if single sign-on is down for a day, and who owns that call. Authentication availability is a business continuity question.	Ask for a one-page version gap check before partner commitments are made.	Forecast conditional revenue and capacity as conditional. Reimbursement-based awards mean cash is spent before it is recovered.

My Take

Two weeks running, the exploited list has been led by the systems that decide who gets in: F5 and WSO2 last week, NetScaler this week. Identity infrastructure is not a security team's backlog item. It is a shared dependency that every program in the portfolio inherits, and when it needs patching, it needs a window the delivery plan never reserved.

The question to ask is not “are we patched?” but “what stops if single sign-on is down for a day, and who owns that call?” Funding works the same way. A plan that does not separate funded work from hoped-for work will be rewritten in December.

Watch Next

The CMMC Reform Task Force report. DoW suspended CMMC Phase II on July 13 and gave a task force 60 days to review the program. As of October 5 I could not find a published report or restart date. Until it lands, Phase I self-assessments, SPRS scores, and DFARS 252.204-7012 obligations stay in force.

December 11. The continuing resolution expires then. Until Congress passes full-year appropriations or another continuing resolution, treat new-start-dependent scope as conditional.