Our automated tracking framework flagged that CISA added CVE-2026-88779 (Citrix NetScaler) to the Known Exploited Vulnerabilities (KEV) catalog on October 5, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-88779 by October 7, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-88779 |
| Vendor / product | Citrix NetScaler |
| Vulnerability | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability |
| CVSS base score | 7.5 |
| Added to KEV | October 4, 2026 |
| Days public before listing (NVD → KEV lag) | 0 |
| Federal patch deadline | October 7, 2026 |
| Known ransomware use | No |
How This Compares to Citrix’s Track Record
This one was listed on or before its public disclosure (a lag of 0 days) — a zero-day exploited at or before the vulnerability was even published.
| Citrix in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 27 |
| Median lag (public → KEV listing) | 37 days |
| 0-day rate (exploited at or before disclosure) | 30% |
| Entries tied to known ransomware campaigns | 7 |
For perspective, the median across all 1734 tracked KEV entries is 245 days — Citrix’s exploited vulnerabilities are flagged faster than the catalog average.
Other Recent Citrix KEV Additions
The most recent Citrix vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-88771 | NetScaler | September 27, 2026 | 0 | No |
| CVE-2026-88772 | NetScaler | September 27, 2026 | 0 | No |
| CVE-2026-19490 | NetScaler | September 9, 2026 | 21 | No |
| CVE-2026-8452 | NetScaler ADC and NetScaler Gateway | August 26, 2026 | 57 | No |
| CVE-2026-3055 | NetScaler | March 30, 2026 | 7 | No |
Defense guide: How to Detect DDoS Attack: Warning Signs & Defense Playbook — detection signals, attack chain and response steps for this class of attack.
What This Means for Defenders
CISA has added CVE-2026-88779, a vulnerability in Citrix NetScaler, to its Known Exploited Vulnerabilities (KEV) catalog. With a CVSS base score of 7.5, this vulnerability poses a risk for organizations using NetScaler products. Its addition to the KEV catalog on 2026-10-04, with a federal patch deadline of 2026-10-07, means federal agencies must patch by that date; other organizations should too. The 0-day lag between public disclosure and KEV listing indicates immediate, active exploitation, likely occurring before or concurrent with its public announcement.
If you have internet-exposed Citrix NetScaler deployments, prioritize patching CVE-2026-88779 before the 2026-10-07 deadline. The rapid KEV listing suggests that threat actors are exploiting it. This abrupt shift in typical patterns means the window for detection and remediation is extremely narrow. It’s not been linked to ransomware, but its quick weaponization still makes it dangerous.
If you can’t apply the patch immediately, implement compensating controls. Isolate NetScaler devices, restrict network access to only essential services and IP ranges, and enhance monitoring for unusual activity originating from or targeting these devices. Assume active exploitation and hunt for signs of compromise if patching is delayed.
Related Coverage
- Citrix’s CVE-2026-8452 Was Exploited in 57 Days — Faster Than Its 183-Day Median (August 2026)
- Citrix’s CVE-2026-19490 Was Exploited in 21 Days — Faster Than Its 120-Day Median (September 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
