Get real-time updates on Telegram
CVE-2026-88779: netscaler application delivery controller from 13.1 (inclusive), before 13.1-37.282 (exclusive), from 13.1…
CVE-2026-88779 affects Citrix NetScaler. Listed in CISA KEV, added 04-Oct-2026.
Affected technology
netscaler application delivery controller · from 13.1 (inclusive), before 13.1-37.282 (exclusive)
citrix
netscaler application delivery controller · from 13.1 (inclusive), before 13.1-64.28 (exclusive)
citrix
netscaler application delivery controller · from 14.1 (inclusive), before 14.1-73.41 (exclusive)
citrix
netscaler application delivery controller · from 14.1-66.68 (inclusive), through 14.1-73.41 (inclusive)
citrix
netscaler gateway · from 13.1 (inclusive), before 13.1-64.28 (exclusive)
citrix
netscaler gateway · from 14.1 (inclusive), before 14.1-73.41 (exclusive)
citrix
ADC · 0 to before 14.1-73.41, 0 to before 13.1-64.28, 0 to before 14.1-73.41 FIPS, 0 to before 13.1-37.282
NetScaler
Gateway · 0 to before 14.1-73.41, 0 to before 13.1-64.28
NetScaler
Component: Not specified by the source
Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required
What an attacker can do
Source advisory’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality and integrity impact as none; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.
- CWE
- CWE-119
- Vendor
- Citrix
- Product
- NetScaler
- CCR priority
- 80.0 /100 (P1)
- CVSS 3.1
- 7.5 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · NVD
- EPSS
- 0.00592 · percentile 0.46747 · 2026-10-11
- KEV
- yes · added 2026-10-04 · due 2026-10-07
- Exploit signals
- CISA KEV listing.
Required action — CISA
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Provenance
- CISA Known Exploited Vulnerabilities Catalog (JSON) · Source record · observed 2026-10-04 19:26:19.386608+00:00 UTC
- FIRST EPSS daily exploit-probability · Source record · observed 2026-10-11 23:42:05.235979+00:00 UTC
- GitHub Advisory Database · Source record · observed 2026-10-05 23:10:51.172112+00:00 UTC
- NVD CVE API 2.0 · Source record · observed 2026-10-05 23:09:08.830529+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-88779.html