CISA’s Known Exploited Vulnerabilities catalog lists an additional Citrix NetScaler vulnerability following September’s reported zero-day attacks. The agency added CVE-2026-88779 on October 4, describing a memory-buffer flaw in NetScaler ADC and NetScaler Gateway that could cause a denial of service.
That entry follows CVE-2026-88771, which CISA added on September 27. The agency describes that vulnerability as improper input validation that could let an unauthenticated attacker execute arbitrary commands. Both appear in the catalog’s October 26 release, establishing that CISA recognizes them as exploited vulnerabilities, while distinguishing their potential effects.
According to SecurityWeek’s account, unidentified attackers began exploiting previously undisclosed NetScaler flaws around mid-September. Dutch government threat analysts and private incident responders detected suspicious traffic, and resellers and security advisories urged administrators to restrict or disconnect internet-facing deployments over the weekend of September 26. SecurityWeek reports that Citrix released patches that Sunday for vulnerabilities tracked from CVE-2026-88771 through CVE-2026-88778.
NetScaler combines functions such as reverse proxying, load balancing, web application firewall protection and SSL VPN access. Its position at the network edge makes the distinction between command execution and service disruption consequential: the two catalog entries describe different capabilities, and should not be treated as interchangeable.
For CVE-2026-88771, CISA explicitly requires forensic triage under its BOD 26-04 guidance alongside vendor-directed mitigations. Its notes say running the provided indicators of compromise in the NetScaler console may help identify exploitation. The entry for CVE-2026-88779 marks forensic triage as “No” and also directs organizations to apply vendor mitigations. The listed remediation deadlines were September 30 and October 7, respectively.
SecurityWeek speculated that unpublished sequential CVE identifiers might signal further advisories. CISA’s dated entry establishes that CVE-2026-88779 was subsequently listed as exploited; it does not establish the status of the remaining identifiers. The catalog records ransomware campaign use as unknown for both listed vulnerabilities.
