Skip to content

CVE · Exploited · On CISA KEV

CVE-2026-88772

Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

8.1
CVSS 3.1
2
stories
SEP 27
added to KEV
Severity
8.1 High · NVD score
Vendor
Citrix
Product
NetScaler
Published
Sep 27, 2026
Added to KEV
Sep 27, 2026
KEV deadline
Sep 30, 2026
Ransomware use
Unknown
Weakness
CWE-119
Part of Citrix NetScaler Zero-Days →

What it is

Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 2 stories

Newest first ↑
  1. VulnerabilitiesResearchers Warn of Citrix NetScaler ExploitationOn Saturday, researchers from watchTowr Labs said they had credible information that attackers were exploiting an unknown RCE vulnerability in Citrix NetScaler boxes.DENNIS FISHER · 3 MIN
  2. VulnerabilitiesNew Citrix NetScaler Issue EmergesThe vendor says this is a configuration-dependent issue rather than a failure of the security patches themselves.DENNIS FISHER · 3 MIN

Official references

4 sources

Registries

RegistryNVDScore, weakness and every referenceRegistryCVE.orgThe official CVE recordRegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisorysupport.citrix.com/support-home/kbsearch/article