CISA added CVE-2026-88779 to its Known Exploited Vulnerabilities catalog on October 4. The memory-bounds flaw affects Citrix NetScaler ADC and NetScaler Gateway, and exploitation can disrupt service. For teams whose remote access or application delivery depends on those appliances, this is an availability problem. Check the affected builds for this CVE separately from earlier NetScaler findings.
Federal civilian agencies have an October 7 remediation deadline in the CISA entry. Other NetScaler operators should move exposed appliances to the front of the maintenance queue and check their builds against this CVE’s thresholds.
Exploitation threatens appliance availability
CISA describes an “improper restriction of operations within the bounds of a memory buffer” and says the flaw “could allow for a denial of service.” The affected products sit on paths that people use to reach internal applications. Losing a Gateway or ADC service can interrupt that access.
The CVE record published by NetScaler scores the issue 8.7 under CVSS 4.0, with network attack vector, low attack complexity, no required privileges or user interaction, and high availability impact. That vector describes the vendor’s technical assessment. CISA’s KEV listing supplies the separate exploitation signal. Its ransomware-use field is marked “Unknown”; plan the response around exploited service disruption.
ADC and Gateway build thresholds
The NetScaler-assigned CVE record lists ADC versions before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282 as affected. For Gateway it lists versions before 14.1-73.41 and before 13.1-64.28. Compare each appliance’s product and build with the matching vendor release, including the separately listed ADC FIPS and 13.1-37.282 entries. The CVE describes denial of service; earlier NetScaler code-execution findings are different cases.
CISA directs operators to apply vendor mitigations and conduct forensic triage under its cited guidance. It also asks stakeholders to evaluate each asset’s internet exposure. Start triage with exposed affected appliances and follow Citrix’s current advisory for incident checks appropriate to your deployment.
Move affected appliances onto fixes
Inventory NetScaler ADC and Gateway appliances, record the installed version and build alongside each asset’s internet-reachability status, and upgrade affected branches to a vendor-supported release at or beyond the relevant CVE threshold. Follow Citrix’s advisory for branch-specific mitigations and CISA’s forensic-triage direction for exposed appliances. If mitigation is unavailable, CISA directs agencies to discontinue use of the product under the applicable guidance.
After the maintenance window, read the installed build from each appliance again and compare it with the corresponding ADC or Gateway threshold. A planned change or an earlier NetScaler patch is a poor substitute for that on-device check. Keep the exposure list alongside the result so the team can prioritize any appliance that still runs an affected build.