CVE-2026-88779: listed in the CISA KEV catalog

CVE-2026-88779 · KEV 2026-10-04 · patch available

Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.

Is CVE-2026-88779 exploited?

• Listed in the CISA KEV catalog on 2026-10-04.
• Federal remediation due 2026-10-07.
• Past that date by 2 days.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

• Citrix Systems · NetScaler · ADC <13.1-64.28
• Citrix Systems · NetScaler · Gateway <14.1-73.41
• Citrix Systems · NetScaler · ADC <14.1-73.41
• Citrix Systems · NetScaler · ADC NDcPP <13.1-37.282
• Citrix Systems · NetScaler · ADC FIPS <13.1-37.282
• Citrix Systems · NetScaler · ADC FIPS <14.1-73.41
• Citrix Systems · NetScaler · Gateway <13.1-64.28
• NetScaler · ADC · >= 0, < 14.1-73.41, >= 0, < 13.1-64.28, >= 0, < 14.1-73.41 FIPS, >= 0, < 13.1-37.282
• NetScaler · Gateway · >= 0, < 14.1-73.41, >= 0, < 13.1-64.28

Is there a patch?

• NetScaler ADC 13.1-64.28
• NetScaler Gateway 14.1-73.41
• NetScaler ADC 14.1-73.41
• NetScaler ADC NDcPP 13.1-37.282
• NetScaler ADC FIPS 13.1-37.282
• NetScaler ADC FIPS 14.1-73.41
• NetScaler Gateway 13.1-64.28

What PlainSec published about CVE-2026-88779

• Citrix NetScaler flaw keeps the front door exposed (2026-10-08)
• Citrix NetScaler Escalates Past Chrome’s Routine Fix (2026-10-06)

Primary sources

• NVD record
• CISA KEV catalog

What this record does not say

• No CVSS score from NVD.
• No EPSS score.

KEV and EPSS are re-checked daily. Record last updated 2026-10-08.