CVE-2026-88779: Citrix NetScaler ADC/Gateway Memory Buffer DoS (KEV)

CVE-2026-88779 is a memory-buffer-bounds flaw (CWE-119) in Citrix NetScaler ADC and NetScaler Gateway that lets a remote attacker trigger a denial-of-service condition on the appliance, and CISA added it to the Known Exploited Vulnerabilities catalog within days of disclosure, giving agencies only a 3-day remediation window.

CVE-2026-88779 is an improper restriction of operations within the bounds of a memory buffer (CWE-119) in Citrix NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). NVD's description is terse — "Vulnerability in NetScaler ADC and NetScaler Gateway" — but its own weakness and configuration data are substantive: the affected builds are ADC and Gateway before 14.1-73.41 and 13.1-64.28, plus separate FIPS/NDcPP-certified builds before 13.1-37.282 and the 14.1-66.68 through 14.1-73.41 FIPS range (NVD).

This page cites NVD rather than Citrix's own knowledge-base article (CTX697174) because that article is a JavaScript-rendered single-page app that returned no readable content to an automated fetch, and Citrix's companion TechZone blog post on this CVE returned an HTTP 403 (access denied) when fetched for this page; neither of those claims is repeated here as a result — only what NVD and CISA independently publish (Citrix KB CTX697174).

NVD gives this CVE its own Primary CVSS v3.1 score of 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H — network-reachable, low complexity, no privileges or user interaction required, but impact limited to availability (no confidentiality or integrity loss), consistent with a crash/denial-of-service bug rather than code execution. Citrix's own CNA submission separately scores it CVSS v4.0 8.7 (NVD).

CISA's KEV entry independently confirms the nature of the bug — "Citrix NetScaler ADC ... and Citrix NetScaler Gateway ... contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service" — and records the CVE added on 2026-10-04 with a required-action due date of just 2026-10-07, a 3-day window typical of CISA's response to vulnerabilities already under active exploitation (CISA KEV).

As of 2026-10-27, FIRST scores the probability of exploitation at 0.11388 (95.971th percentile) — high, consistent with KEV listing and an internet-facing network appliance that is a known target for mass scanning (FIRST EPSS).

Because NetScaler ADC/Gateway appliances are frequently exposed directly to the internet and this flaw is already being exploited for denial of service, operators on the affected 13.1 and 14.1 builds listed above should upgrade to 13.1-64.28 / 14.1-73.41 or later (or the corresponding FIPS/NDcPP-certified build) as soon as possible and consult Citrix's own advisory directly once it is reachable for any supplementary mitigation guidance.

• Improper restriction of operations within the bounds of a memory buffer (CWE-119) in NetScaler ADC/Gateway; affected builds are 13.1 before 13.1-64.28 and 14.1 before 14.1-73.41, plus separate FIPS/NDcPP version ranges. — NVD
• NVD's own Primary CVSS v3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, availability-only impact); Citrix's separate CNA submission scores it CVSS v4.0 8.7. — NVD
• CISA independently describes the flaw as a memory-buffer-bounds issue that could allow denial of service; added to KEV on 2026-10-04 with a required-action due date of 2026-10-07. — CISA KEV
• Citrix's own knowledge-base article (CTX697174) is JavaScript-rendered with no readable static content, and Citrix's TechZone blog post on this CVE returned HTTP 403 when fetched; this page does not source any claim to either. — Citrix KB CTX697174
• EPSS score is 0.11388 (95.971th percentile) as of 2026-10-27. — FIRST EPSS