Citrix NetScaler Memory Buffer Vulnerability Added to CISA KEV

What's on the official record

CISA added CVE-2026-88779 to the Known Exploited Vulnerabilities Catalog on 4 October 2026. The vulnerability is an improper restriction of operations within the bounds of a memory buffer (CWE-119) in Citrix NetScaler ADC and Citrix NetScaler Gateway that could allow for a denial of service. CISA's remediation due date for federal civilian agencies is 7 October 2026, and the catalog version is 2026.10.21. The CVE record names fixed versions 14.1-73.41 and 13.1-64.28. The catalog does not record known ransomware use. FIRST's EPSS model estimates a 0.006 probability of exploitation (48th percentile, 23 October 2026). CISA's ADP records exploitation as active, automatable, with partial impact.

Assessment

For a platform or AI-stack owner, the record lets you check whether any NetScaler ADC or NetScaler Gateway instance in your estate runs a version before 14.1-73.41 or 13.1-64.28, and to patch or isolate those instances to the fixed versions the CVE record names. The catalog's active-exploitation and automatable markings support treating this as a patch-or-isolate decision rather than a monitor-and-wait one.

For a cyber underwriter, the record lets you check whether a policyholder's NetScaler ADC or NetScaler Gateway estate is at or above the fixed versions 14.1-73.41 and 13.1-64.28, and to require that control as a condition of binding or renewal. The catalog does not record known ransomware use, so the record supports pricing or control decisions without a ransomware-loss signal.

What would change this call

A change to the CVE record naming additional or different fixed versions would change the patch target. A catalog update recording known ransomware use would change the underwriting posture. A revision to CISA's SSVC assessment would change the urgency of the patch-or-isolate call.

What to check next

Check	Why
NetScaler ADC and Gateway versions in the estate against 14.1-73.41 and 13.1-64.28	Confirm whether any instance is below the fixed versions the CVE record names
CISA KEV catalog for a revised dueDate or catalogVersion	Confirm the remediation deadline and catalog state
CVE record for updated fixed-version guidance	Confirm the patch target has not changed

Confidence

Filed 25 October 2026 from the record dated 4 October 2026.

Sources

[1] Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-88779

[2] CVE record CVE-2026-88779 — https://www.cve.org/CVERecord?id=CVE-2026-88779

[3] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

AI assistants read this note with get_note cyb-20261004-cve-2026-88779. Connect yours