cyfenced.com →

[ CVE-2026-88779 · Published 4 Oct 2026 ]

Exploited denial of service flaw in NetScaler ADC and Gateway

Exploited · CISA KEV CVSS 7.5 EPSS <1%4 agency advisoriesFix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2026-10-04
  • Urgent advisory from CERT-FR

[ Analyst view ]Is this a red alert for you?

Red alert

CISA lists it as exploited and it needs no credentials, although the impact is an outage rather than a takeover.

Red alert if
Your business relies on a NetScaler ADC or Gateway reachable from the internet that runs a build older than 14.1-73.41 or 13.1-64.28.
Can wait if
You do not use NetScaler, or you already run the fixed builds.
What it is
A memory buffer flaw in NetScaler ADC and NetScaler Gateway lets a remote attacker crash the appliance. It is fixed in 14.1-73.41 and 13.1-64.28 (and 14.1-73.41 FIPS and 13.1-37.282), which are later builds than the fix for CVE-2026-88771.
Impact
An attacker without credentials can take the appliance offline, but cannot read or change data with this flaw alone. Where NetScaler carries remote access or load balancing for business applications, that means staff and customers lose access until the appliance recovers.

How an attack would work MITRE ATT&CK

  1. T1190 Exploit Public-Facing ApplicationThe attacker sends crafted traffic to the NetScaler service exposed to the internet.
  2. T1499 Endpoint Denial of ServiceThe traffic crashes the appliance and interrupts the services behind it.

What to do

  1. Upgrade NetScaler ADC and Gateway to 14.1-73.41 or 13.1-64.28 or later, as described in Citrix bulletin CTX697174.
  2. Check that the build you installed for CVE-2026-88771 is not older than these; 14.1-73.37 and 13.1-64.23 do not fix this flaw.
  3. Watch the appliance for unexpected restarts or crashes until the upgrade is done.
Written with AI from the sources on this page on 23 Oct 2026. Check the vendor's advisory before you act.

[ Description ]Official description

Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.

CISA: Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 7 Oct 2026): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

[ Advisories ]Government CERT advisories

[ References ]References