CVE-2026-88772
CISA KEV
ACT NOW
Priority: 0.00
BB Relevance:
10/100
Published: N/A
Modified: N/A
First seen: 2026-10-29
Status: pending_score
Description
Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service
CISA Known Exploited Vulnerability
Vendor / Product
Citrix — NetScaler
Date Added
2026-09-27
Remediation Due
2026-09-30
Running the provided IOCs in the NetScaler console may help identify indicators of exploitation. Customers must conduct forensic triage as directed by BOD 26‑04 and follow Citrix’s published guidance for mitigations. For more information, please see: https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778 ; https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 ; https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-88772
Weakness Classification (1)
Affected Software (7)
| Vendor | Product | Version |
|---|---|---|
| citrix | netscaler_application_delivery_controller | 13.1 – 13.1-64.23 |
| citrix | netscaler_application_delivery_controller | 13.1 – 13.1.37.279 |
| citrix | netscaler_application_delivery_controller | 13.1 – 13.1.37.279 |
| citrix | netscaler_application_delivery_controller | 14.1 – 14.1-73.37 |
| citrix | netscaler_application_delivery_controller | 14.1-66.68 – 14.1-73.37 |
| citrix | netscaler_gateway | 13.1 – 13.1-64.23 |
| citrix | netscaler_gateway | 14.1 – 14.1-73.37 |
References & Advisories (2)
Vendor Advisory
US Government Resource