On October 4, 2026, CISA added CVE-2026-88779 to its KEV catalog. It affects Citrix NetScaler ADC and NetScaler Gateway. Deadline: October 7.
It follows directly on the September 27 wave, when CVE-2026-88771 and CVE-2026-88772 entered KEV (see our article on those two CVEs). If you patched last week, you're not done.
| Field | Value |
|---|---|
| CVSS | not published by NVD as of writing |
| Vector | not published |
| NVD published | not yet |
| CISA KEV | added 2026-10-04, due 2026-10-07 |
What We Know
Not much. CISA describes it as an improper restriction of operations within the bounds of a memory buffer — the same class of flaw as CVE-2026-88772 — that could lead to denial of service.
NVD hasn't published a score or affected versions as of writing. I won't make either up: Citrix's security bulletin is authoritative.
Two remarks anyway:
- Denial of service on NetScaler isn't trivial. When the gateway goes down, the whole organisation's remote access goes with it, or the applications it load-balances.
- CISA describes it as leading to denial of service. With memory buffer flaws, the real impact can evolve as analysis progresses. Don't lower the priority because it's "only" a DoS: it's being exploited.
Versions
No affected or fixed versions published by NVD as of writing. Compare each appliance's build (hardware, VPX, SDX) with those listed in Citrix's bulletin — even if you already applied the late-September fixes: a build that fixes 88771 and 88772 doesn't necessarily fix 88779.
What It Changes for Your Patch Plan
On NetScaler, fixes rarely come alone. Three KEV entries in eight days is a sign that attackers are actively working on this device family, and that more flaws may follow.
In practice:
- Don't close the late-September ticket until the installed build also covers CVE-2026-88779.
- Plan a short, repeatable maintenance window: if you have to reboot appliances every week, the procedure had better be well rehearsed, with failover to the secondary node of an HA pair.
- Record every appliance's build in one place. The day Citrix's bulletin comes out, it's the only information you need.
Detection
- Unexpected reboots or NetScaler process crashes, recent core dump files
- Service interruptions on Gateway or load-balancing vServers with no identified cause
- Logs: spikes of abnormal requests to exposed vServers just before an incident
Mitigation
- Apply Citrix's fixed build for your branch before October 7.
- Check end-of-life branches: if your version is no longer supported, the only lasting mitigation is migrating.
- Restrict the management interface (NSIP) to admin networks.
- Keep an eye on Citrix's bulletin: the impact description may be updated.
Why Continuous Monitoring of Access Gateways Matters
Three NetScaler CVEs in KEV in eight days, one with no NVD score: that's the pace edge devices impose. Tracking has to start from CISA's catalog, not just NVD.
With cveo.tech, inventory your gateways with exact builds, and get alerted whenever a CVE enters CISA KEV for one of them.