CVE-2026-88779Vulnerability
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Reported by 17 independent sources · first reported by CISA advisories · last reported
Last reported 5 days ago
Fix due 7 Oct 2026
Used by ransomware: not knownCISA KEV catalogue
higher than 47% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
24 reports · the newest 20, newest first · the exact sentence from each-
Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779“Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779”
-
Top RCE Vulnerabilities“Citrix later disclosed a third zero-day, CVE-2026-88779 (8.7 CVSS v4.0), affecting SAML-enabled appliances.”
-
12th October – Threat Intelligence Report“Citrix NetScaler ADC and Gateway appliances are affected by CVE-2026-88779, a high-severity memory overflow vulnerability rated CVSS 8.7.”
-
Risky Bulletin: ShinyHunters suspects arrested in US and Jordan“[Citrix blog // Citrix CVE-2026-88779]”
-
Week in review: FortiBleed is still active, Patch Tuesday forecast“CISA flags new exploited NetScaler flaw as attackers crash appliances (CVE-2026-88779)”
-
Citrix gives NetScaler admins another critical reason to patch“Citrix disclosed another exploited flaw, CVE-2026-88779, last Friday that carries a severity score of 8.7.”
-
CVE-2026-107406: Citrix Fixes Critical NetScaler ADC and Gateway Vulnerability“This week, CISA added the flaw CVE-2026-88779 to its KeV catalog.”
-
Citrix Urges Immediate Patching of Critical NetScaler Vulnerability“Citrix’s fresh warning comes days after the company sounded the alarm on CVE-2026-88779, a zero-day in NetScaler leading to DoS.”
-
Making sure the checks get printed“This latest vulnerability, tracked as CVE-2026-88779, is a memory overflow bug that leads to denial of service attacks.”
-
CVE-2026-88779: Citrix NetScaler Zero-Day“CVE-2026-88779: Citrix NetScaler Zero-Day”
-
Desbordamiento de memoria en productos de Citrix“Para la vulnerabilidad de severidad alta se ha asignado el identificador CVE-2026-88779.”
-
Citrix discloses third actively exploited NetScaler zero-day in less than a week“Researchers and security experts said the vulnerability — CVE-2026-88779 — is less concerning because exploitation triggers denial of service and only impacts instances that have SAML (security assertion markup language) enabled.”
-
Citrix NetScaler security snafus get even worse amid more 0-day reports“This latest vulnerability, tracked as CVE-2026-88779, is a memory overflow bug that leads to denial of service attacks.”
-
CISA flags new exploited NetScaler flaw as attackers crash appliances (CVE-2026-88779)“CISA flags new exploited NetScaler flaw as attackers crash appliances (CVE-2026-88779)”
-
⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests“The vulnerability, tracked as CVE-2026-88779, carries a CVSS score of 8.7 out of 10.0.”
-
Citrix NetScaler Targeted Via New Zero Day“The high-severity vulnerability, CVE-2026-88779, is a memory buffer issue which can affect service availability if certain pre-conditions are met.”
-
U.S. CISA adds Citrix NetScaler flaw to its Known Exploited Vulnerabilities catalog“Cybersecurity and Infrastructure Security Agency (CISA) added a Citrix NetScaler flaw tracked as CVE-2026-88779 (CVSS score of 8.7), to its Known Exploited Vulnerabilities (KEV) catalog.”
-
Vulnérabilité dans Citrix NetScaler ADC et Gateway (05 octobre 2026)“La CISA indique que la vulnérabilité CVE-2026-88779 est activement exploitée.”
-
Bulletin d'actualité CERTFR-2026-ACT-042 (05 octobre 2026)“CVE-2026-88779”
-
Citrix NetScaler vulnerability (CVE-2026-88779) in active exploitation“Citrix NetScaler vulnerability (CVE-2026-88779) in active exploitation”
Indicators reported together
named in the same reports- hxxps://support.citrix[.]com/support-home/kbsearch/article?articleNumber=CTX697174&articleURL=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88779in 2 reports
- 9f1f11a708d393e0…06f18ffcc507in 1 report
- 2915b3f8b703eb744fc54c81f4a9c67fin 1 report
- w32.9f1f11a708-100.sbx[.]tgin 1 report
- 9896a6fcb9bb5ac1…66decd6a4a7fin 1 report
- 38de5b216c33833af710e88f7f64fc98in 1 report
- w32.9896a6fcb9-95.sbx[.]tgin 1 report
Copy these 7 indicators · defanged
Also named with it: CVE-2026-88771, CVE-2026-88772, CVE-2026-104286, CVE-2026-21589, CVE-2026-107406, CVE-2026-89078, CVE-2026-93577, CVE-2026-102331, CVE-2026-76504, CVE-2026-102489, CVE-2026-102490, CVE-2026-60004, CVE-2026-33824
Thanks — we review every report.