CISA Flags Citrix NetScaler Flaw Exploited in Ongoing Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-88779, a high-severity vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway appliances, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation.

Tracked as CVE-2026-88779, this vulnerability involves an improper restriction of operations within the bounds of a memory buffer, also referred to as CWE-119. It can allow an unauthenticated, remote attacker to trigger a denial-of-service condition on vulnerable NetScaler appliances.

Citrix NetScaler Flaw

NetScaler has assigned the flaw a CVSS v4 score of 8.7, categorizing it as High. The CVSS vector indicates that exploitation is network-accessible and requires low attack complexity, no privileges, and no user interaction. The primary impact reported is on system availability.

CISA included this vulnerability in its KEV Catalog on October 4, 2026, mandating that U.S. federal civilian executive branch agencies remediate the issue by October 7, 2026.

The agency advises organizations to implement vendor mitigations under CISA’s Binding Operational Directive 26-04, which prioritizes remediation based on risk and requires forensic triage for affected assets.

The vulnerability affects multiple NetScaler ADC releases, including versions before 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, and 13.1-37.282. Additionally, NetScaler Gateway deployments running versions earlier than 14.1-73.41 or 13.1-64.28 are also at risk.

Organizations operating internet-facing NetScaler infrastructure should promptly identify exposed ADC and Gateway instances, verify their installed versions, and upgrade to the corrected releases.

Security teams should also examine appliance logs, administrative access activity, configuration changes, and unusual traffic patterns for signs of attempted exploitation or service disruption.

While CISA has not publicly linked CVE-2026-88779 to ransomware activities, the KEV entry currently states that the use of ransomware in connection with this vulnerability is unknown.

However, NetScaler appliances remain attractive targets because they often provide remote access, application delivery, and authentication services at the enterprise network edge.

If organizations cannot patch or implement mitigations, CISA advises them to follow applicable cloud-service guidelines or discontinue use of the affected product.

Teams should prioritize externally exposed appliances, preserve relevant forensic evidence, and ensure that remediation is successfully applied across production, disaster recovery, and management environments.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.