CVE record · 9 sources
CVE-2026-88779
KEV · due 7 Oct 2026 (overdue)CVSS 8.7Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- Vendor
- Citrix
- Product
- NetScaler
- CVSS
- 8.7
- EPSS
- 0.11 (p96)
- CISA KEV
- added 4 Oct 2026, due 7 Oct 2026 (25d overdue)
- Weakness
- CWE-119
- Exposure class
- Edge / VPN / firewall, Network management
Coverage
8Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.
-
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of…
-
Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway
Update October 9, 2026 : CISA has updated this Alert to: (1) include CVE-2026-107406; (2) include CVE-2026-88779 following its addition to the KEV Catalog on Oct. 4, 2026; (3) clarify the potential relationship between…
-
Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
Overview In early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14.1 build and was exposed to active exploitation targeting NetScaler…
-
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-88779 Citrix NetScaler Improper Restriction of Operations within the Bounds of a…
-
Citrix NetScaler vulnerability (CVE-2026-88779) in active exploitation
Categories: Threat Research Tags: advisory, vulnerability, Citrix
-
October 2026 Patch Tuesday
What's happened since September Patch Tuesday Here’s a fun fact to start this month. Ivanti’s Vulnerability Knowledge Base is now tracking more than 406,000 CVEs. Over 78,000 of them were disclosed in 2026 alone, which is more…
-
12th October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 12th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Denmark’s government has disclosed a breach involving its Central Register of…
-
Making sure the checks get printed
Pierre's debut newsletter explores the messy, real-world side of risk management and how to keep vital systems running when a perfect patch isn't an option.