CVE · Exploited · On CISA KEV

CVE-2026-88779

Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

7.5: CVSS 3.1
1: story
OCT 4: added to KEV

Severity: 7.5 High · NVD score
Vendor: Citrix
Product: NetScaler
Published: Oct 4, 2026
Added to KEV: Oct 4, 2026
KEV deadline: Oct 7, 2026
Ransomware use: Unknown
Weakness: CWE-119

What it is

Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑

OCT 3
VulnerabilitiesNew Citrix NetScaler Issue EmergesThe vendor says this is a configuration-dependent issue rather than a failure of the security patches themselves.DENNIS FISHER · 3 MIN

Official references

5 sources

Registries

RegistryNVDScore, weakness and every reference RegistryCVE.orgThe official CVE record RegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisorysupport.citrix.com/support-home/kbsearch/article Fixcommunity.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway