CVE-2026-88779

Think of NetScaler as the front door and traffic controller for your company's remote access and web applications. This flaw lets an outsider send a specially crafted request that overflows the device's memory, like overloading a switchboard until it shuts down — knocking out access for your staff or customers until it's fixed.

This matters to you if you run Citrix NetScaler ADC or NetScaler Gateway, commonly used for application delivery, load balancing, or secure remote/VPN access. The flaw is reachable over the network with no login required, so any exposed device running an affected version is at risk — there is no additional condition needed to be vulnerable.

This is urgent: attackers are already exploiting this flaw in real-world attacks, and it's officially listed by CISA as a known exploited vulnerability with a remediation deadline of October 7, 2026. Don't wait for a convenient maintenance window — treat this as an active threat to your availability right now.

Confirm your running build via the NetScaler management console or CLI (show ns version). Affected builds are ADC before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; and Gateway before 14.1-73.41 and before 13.1-64.28. Upgrade to the matching fixed build for your branch: 14.1-73.41 (standard and FIPS), 13.1-64.28, or 13.1-37.282 for older 13.1 branches. There is no documented workaround beyond upgrading — if patching cannot be completed immediately, restrict internet exposure of the management/vulnerable interfaces as an interim mitigation. CISA's BOD 26-04 remediation due date is 2026-10-07; federal and risk-conscious organizations should treat this as the hard deadline. After patching, monitor device logs and uptime for crash/restart anomalies that could indicate continued exploitation attempts.

CWE-119 (improper restriction of operations within memory buffer bounds) enables a network-reachable, unauthenticated denial-of-service condition with no user interaction required; reachable in default configuration. No public exploit code is on record, but confirmed real-world exploitation has led CISA to add this to the KEV catalog (added 2026-10-04, due 2026-10-07), which supersedes the EPSS predictive score for urgency purposes. Exploit maturity should be treated as active/in-the-wild despite the absence of public PoC, consistent with KEV listing criteria.