CVE-2026-88779

Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Citrix NetScalerNetwork & edge

CVSS

8.7High

ExploitationExploited in the wildAdded to KEV 4 Oct 2026CISA KEV

Exploit odds (EPSS)0.59%Chance of exploitation activity in the next 30 days, higher than 47% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in14.1-73.41Also 13.1-64.28, 14.1-73.41 FIPS and 1 moreCVE List

Federal deadline7 Oct 2026Remediation due date for US federal agenciesCISA KEV

CISA required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA KEV

What fixes it

14.1-73.41ADCCVE List
13.1-64.28ADCCVE List
14.1-73.41 FIPSADCCVE List
13.1-37.282ADCCVE List
14.1-73.41GatewayCVE List
13.1-64.28GatewayCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

4 Oct 2026, 02:35 UTCPublishedCVE List
4 Oct 2026Added to CISA KEVCISA KEV
19 Oct 2026, 15:11 UTCFirst reported exploitedRapid7

Reports 1

1 outlets reports exploitation. Reports are not confirmation; each links to its source.

Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779Rapid7, 19 Oct 2026Exploitation reportedZero-day

Description

Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.

Text from CVE List

Affected versions 6

ADCaffected: all versions before 14.1-73.41CVE List
ADCaffected: all versions before 13.1-64.28CVE List
ADCaffected: all versions before 14.1-73.41 FIPSCVE List
ADCaffected: all versions before 13.1-37.282CVE List
Gatewayaffected: all versions before 14.1-73.41CVE List
Gatewayaffected: all versions before 13.1-64.28CVE List