AX·NEWS
Sign in

Vulnerability

CVE-2026-88779 — Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

high 8.7 Exploited in the wild 4 stories · 4 outlets

Official record (cve.org)NVDCVE watch

Impacted if

  • NetScaler ADC < 14.1-73.41 · < 13.1-64.28 · < 13.1-37.282
  • NetScaler Gateway < 14.1-73.41 · < 13.1-64.28

Memory corruption · over the network · no login

Vulnerability in NetScaler ADC and NetScaler Gateway.

CISA Known Exploited Vulnerabilities

Added on 2026-10-04, federal remediation due 2026-10-07. Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

First seen by AX-NEWS · latest story . Severity: NVD, or the CVE record while the NVD has not scored it. This product uses data from the NVD API but is not endorsed or certified by the NVD.

Coverage

  1. Citrix discloses third actively exploited NetScaler zero-day in less than a week
    USCyberScoop Asia Cybersecurity

    Citrix customers just got through back-to-back weekends filled with varying levels of uncertainty and worry, as yet another actively exploited zero-day vulnerability was discovered in Citrix NetScaler products. Researchers and security…

  2. New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline
    INThe Hacker News Cybersecurity

    Citrix has released security updates for a high-severity security flaw in NetScaler ADC and NetScaler Gateway that has been exploited as part of targeted zero-day attacks. The vulnerability, tracked as CVE-2026-88779, carries a CVSS score…

  3. Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier
    USSecurityWeek Cybersecurity

    Citrix has confirmed that a new zero-day vulnerability, CVE-2026-88779, emerged just days after two other exploited flaws were patched. The post Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier appeared first…

  4. Citrix patches NetScaler SAML zero-day exploited in attacks
    USBleepingComputer Cybersecurity

    Citrix has released emergency updates for a new NetScaler denial-of-service vulnerability tracked as CVE-2026-88779 that has been exploited in zero-day attacks, with researchers investigating whether it can also be exploited for remote…