CVE-2026-88779: Citrix NetScaler ADC & Gateway Memory Buffer Flaw Enables Denial of Service

What Is the Vulnerability?

CVE-2026-88779 is an improper restriction of operations within the bounds of a memory buffer (classified under CWE-119) affecting Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway). The vulnerability was published to the NVD on 4 October 2026 and added to the CISA Known Exploited Vulnerabilities (KEV) catalog on the same date.

The root cause is insufficient bounds checking on memory buffer operations within the NetScaler software. When exploited, this allows an attacker to force the application into an invalid memory state, resulting in a service crash. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) tells a clear story:

• Network-accessible: No local or adjacent-network access is required.
• Low complexity: No special conditions or race conditions are needed to trigger the flaw.
• No privileges, no user interaction: An unauthenticated attacker with no prior foothold can exploit this directly.
• Availability impact is HIGH: A successful exploit fully disrupts the targeted service.
• No confidentiality or integrity impact: Based on current CVSS scoring, data theft or tampering is not the direct risk here — availability is.

The absence of a confidentiality or integrity component does not make this flaw low-priority. For organisations relying on NetScaler for VPN termination, application delivery, or zero-trust access, a denial-of-service condition against this gateway is a business-critical outage.

Who and What Is Affected?

The following Citrix product lines and version ranges are confirmed as vulnerable, as described in the NVD entry:

Organisations running any of the above version branches on-premises or in cloud environments should treat those instances as affected until patched. If you are unsure which version is running, consult your Citrix management console or the CLI command appropriate to your platform, and cross-reference against Citrix's official advisory.

NetScaler appliances are frequently internet-facing — deployed as VPN gateways, reverse proxies, and load balancers — which significantly increases exposure to unauthenticated remote attack.

What Is the Impact?

The direct, confirmed impact of CVE-2026-88779 is denial of service. An unauthenticated remote attacker can send crafted network traffic that triggers the out-of-bounds memory operation, causing the NetScaler process to crash or become unresponsive.

For organisations, this translates to real operational consequences:

• VPN and remote access outages: NetScaler Gateway is widely used as the front door for remote workforce access. A successful DoS attack locks out all remote users simultaneously.
• Application delivery disruption: NetScaler ADC sits in front of business-critical applications. Crashing the ADC removes load balancing, SSL offload, and application firewall capabilities in one event.
• Potential for repeated attacks: If the service auto-restarts, an attacker can trigger repeated crashes, creating a sustained outage rather than a single incident.
• Incident response burden: CISA's KEV listing means exploitation has been observed in the wild. Organisations should assume that scanning or probing of this vulnerability is active and ongoing.

The CISA KEV entry explicitly states this vulnerability "could allow for a denial of service." Because exploitation has been confirmed in the wild per CISA's listing, this is not a theoretical risk.

What To Do Right Now

CISA's required action for this KEV entry is clear: apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 guidance, and follow applicable BOD 26-04 guidance for cloud services — or discontinue use of the product if mitigations are unavailable. The following steps reflect that guidance:

1. Inventory immediately. Identify every NetScaler ADC and NetScaler Gateway instance in your environment, including cloud-hosted deployments. Record the exact version of each.
2. Prioritise internet-facing instances. Appliances reachable from the public internet are at greatest risk and must be patched first. Refer to CISA BOD 26-04 for mandated patching timelines applicable to US federal agencies; other organisations should treat this with equivalent urgency.
3. Apply the vendor patch. Upgrade to the fixed versions listed above. Obtain updates from Citrix's official download portal and verify the integrity of update packages before applying. Consult Citrix's own advisory for the definitive upgrade path.
4. Apply interim mitigations if patching is delayed. Review Citrix's advisory for any documented workarounds. Document any decision to delay patching with a formal risk acceptance.
5. Conduct forensic triage. CISA BOD 26-04 includes specific forensic triage requirements for KEV-listed vulnerabilities. Review CISA's guidance (referenced in the KEV entry notes) and determine whether indicators of compromise should be sought before or during patching.
6. Verify after patching. Confirm the running version matches the patched release. Test availability of dependent services post-upgrade.
7. Monitor for anomalous traffic. Even after patching, review logs for unusual connection patterns to NetScaler management or data-plane interfaces that may indicate prior reconnaissance or exploitation attempts.

Primary references: NVD entry for CVE-2026-88779 | CISA KEV Catalog | Citrix Security Bulletins (via support.citrix.com).

How Continuous External Testing Surfaces This Exposure

CVE-2026-88779 illustrates a recurring pattern: a network-facing appliance trusted to protect the perimeter becomes the perimeter's weakest point. The CVSS vector — no authentication, no user interaction, low attack complexity — means that any internet-facing NetScaler running a vulnerable version is an easy, identifiable target for automated scanning tools.

Organisations that rely on annual or point-in-time penetration testing alone may not discover a newly disclosed vulnerability like this until the next engagement, leaving a gap of weeks or months. Continuous external attack surface testing addresses this directly:

• Version detection at the edge: External scanning can identify exposed NetScaler instances and flag version strings or behavioural fingerprints that fall within the vulnerable range, often within hours of a CVE being published.
• Exposure confirmation without exploitation: A responsible continuous testing programme can confirm whether an asset is reachable and potentially vulnerable without triggering a denial of service — giving security teams the evidence they need to escalate patching without causing an outage.
• Change detection: New NetScaler instances spun up in cloud environments or following infrastructure changes may not be captured in a static asset register. Continuous external scanning catches these shadow assets before attackers do.
• Prioritisation data for patching teams: When a KEV-listed vulnerability is confirmed as reachable from the internet, that is the signal to move it to the top of the patching queue — above internally-only-reachable vulnerabilities of a similar or even higher CVSS score.

Treating network appliances as outside the scope of external testing is a blind spot that adversaries actively exploit. A continuous external programme ensures that your tested perimeter matches your actual attack surface.

Frequently asked questions

Does CVE-2026-88779 allow an attacker to steal data or take over the NetScaler appliance?

Based on the CVSS 3.1 scoring provided, the confirmed impact is limited to availability — denial of service. The vector shows no confidentiality or integrity impact (C:N/I:N). This means the vulnerability, as currently scored, does not directly allow data theft or remote code execution. However, a crashed gateway can itself cause secondary security risks by disrupting protective controls.

Is this vulnerability being actively exploited?

Yes. CVE-2026-88779 was added to the CISA Known Exploited Vulnerabilities catalog on 4 October 2026, which means CISA has confirmed evidence of active exploitation in the wild. Organisations should treat this as an actively targeted flaw and prioritise patching accordingly.

What if we cannot patch immediately — are there workarounds?

CISA's required action directs organisations to apply mitigations in accordance with Citrix's vendor instructions. Check Citrix's official security advisory for any documented interim mitigations. If no mitigations are available and patching cannot be completed within BOD 26-04 timelines, CISA advises discontinuing use of the product. Any delay should be formally documented as a risk acceptance.

Does this affect NetScaler instances hosted in cloud environments?

Yes. The NVD description specifies affected version ranges for NetScaler ADC and NetScaler Gateway without restricting scope to on-premises deployments. CISA's required action explicitly references cloud services and states that applicable BOD 26-04 guidance for cloud services applies. All deployments, regardless of hosting model, should be inventoried and assessed.