Grade One Press

Technology reporting you can check

News · Security & privacy

A fifth exploited Citrix NetScaler flaw since August; US agencies get until 7 October to act

The flaw lets an attacker knock NetScaler ADC and Gateway appliances offline without logging in. Versions fixed for September's flaws are still affected.

Grade One Newsroom · 1 min read

Sources: 2 · top grade 1How evidence is graded

Another Citrix NetScaler flaw is being exploited; September's fixed versions are affected

Grade 1 · Primary

Source: US Cybersecurity and Infrastructure Security Agency (CISA)

What changed
CISA listed CVE-2026-88779 in Citrix NetScaler ADC and Gateway as exploited on 4 October, the day it was published, with a 7 October deadline for US agencies.
Who it affects
Organisations running NetScaler ADC or Gateway before 14.1-73.41 or 13.1-64.28, including FIPS editions; that includes September's fixed releases.
What it does not tell you
How many appliances are exposed or have been attacked, or by whom. Neither CISA nor the CVE record says.

The full story Check the source

The US Cybersecurity and Infrastructure Security Agency added a flaw in Citrix NetScaler ADC and NetScaler Gateway to its catalogue of exploited vulnerabilities on 4 October. It gave federal agencies until 7 October to act [1].

The flaw, CVE-2026-88779, is a memory-buffer error that "could allow for a denial of service": an attacker can make the appliance stop working [1]. NetScaler rates it 8.7 out of 10, and says no login or user action is needed [2].

It is the fifth NetScaler flaw CISA has listed as exploited since 26 August, after one on 26 August, one on 9 September and two on 27 September [1].

What it covers

NetScaler ADC and Gateway versions before 14.1-73.41 and before 13.1-64.28, and ADC FIPS editions before 14.1-73.41 FIPS and 13.1-37.282 [2].

That includes the releases that fixed the two September flaws, 14.1-73.37 and 13.1-64.23: organisations that updated last week need to update again [2].

CISA tells agencies to apply Citrix's fixes, follow its forensic triage requirements, and stop using the product where fixes cannot be applied [1].

What it does not tell you

How many appliances are exposed or have been attacked, or who is behind it. The sources do not say [1][2].

Whether the flaw allows more than a shutdown. The record describes denial of service only, and CISA rates its technical impact as partial [2].

Sources and their grades

  1. US Cybersecurity and Infrastructure Security Agency (CISA), Known Exploited Vulnerabilities Catalog, entry CVE-2026-88779. Read 5 October 2026. Grade 1 · Primary Added 4 October 2026, due 7 October. A listing means CISA has evidence of exploitation. Read from CISA's catalogue feed.
  2. CVE Program (record filed by NetScaler), CVE-2026-88779, Memory overflow vulnerability leading to Denial of Service. Read 5 October 2026. Grade 3 · Filed record Published 4 October 2026. Affected versions and the severity score are the vendor's own; CISA's annotation marks exploitation as active.

A grade says how much weight a source will take, from 1 (a body that can compel an answer and has nothing to sell) to 5 (somebody describing what they sell, or themselves). The standard sets out what each grade may be used for.

Filed under Remote access Vulnerabilities

Comments

Commenting needs an account, made with nothing but an email address. A first comment is read before it appears.

More news

See all