CISA Warns of Citrix NetScaler Vulnerability Actively Exploited in Attacks

The U.S. Cybersecurity and Infrastructure Security Agency has added a Citrix NetScaler vulnerability, tracked as CVE-2026-88779, to its Known Exploited Vulnerabilities catalog after confirming active exploitation.

The flaw affects Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway). CVE-2026-88779 is an improper restriction of operations within the bounds of a memory buffer issue, classified under CWE-119.

The vulnerability could allow an attacker to trigger a denial-of-service condition on affected NetScaler appliances, potentially disrupting access to business applications, remote services, and network resources delivered through the devices.

CISA added the vulnerability to the KEV catalog on October 4, 2026, and set an October 7, 2026, remediation deadline for federal civilian executive branch agencies.

The agency requires organizations to apply vendor-provided mitigations under Binding Operational Directive 26-04, which prioritizes security updates based on risk.

Citrix NetScaler Vulnerability Exploited

The short remediation window highlights the urgency of the issue. NetScaler ADC and Gateway products are commonly exposed to the internet. They are frequently used to provide secure remote access, application delivery, load balancing, and virtual private network services.

A service-disruption vulnerability affecting these systems can create significant operational impact, especially for organizations that depend on them for employee or customer connectivity.

CISA’s listing confirms active exploitation but does not state whether the vulnerability has been used in ransomware operations. The agency marked ransomware use as unknown.

However, it also requires forensic triage for affected assets, indicating that organizations should not treat patching as the only required response. Security teams should first identify all internet-facing and internally deployed NetScaler ADC and Gateway appliances.

Administrators should verify the installed software version, review Citrix security guidance, and deploy the available fix or mitigation as soon as possible. If no mitigation is available, CISA advises organizations to discontinue use of the affected product where feasible.

Forensic teams should examine device logs and surrounding network telemetry for unusual traffic, repeated crashes, unexpected service restarts, configuration changes, suspicious administrator activity, and indicators of post-exploitation access. Organizations should also review authentication records for remote-access services hosted through NetScaler appliances.

The vulnerability reinforces a recurring security concern around edge infrastructure. Because appliances such as NetScaler sit between external users and internal systems, they are attractive targets for attackers seeking an initial foothold or a way to interrupt critical services.

Fast asset discovery, exposure reduction, patch validation, and incident triage are essential when an edge-device flaw enters CISA’s actively exploited catalog.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup into your SOC