CISA Adds Exploited Citrix NetScaler Flaw CVE-2026-88772 to KEV Catalog

CISA added CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) catalog on September 27, 2026. A KEV listing means the agency has evidence the flaw is being exploited in the wild.

The flaw affects Citrix NetScaler ADC and NetScaler Gateway.

CISA describes it as an improper restriction of operations within the bounds of a memory buffer (CWE-119) that could allow remote code execution or denial of service. Citrix's security bulletin, CTX697096, calls it a memory overflow and says it applies when DTLS is enabled on NetScaler ADC or NetScaler Gateway, which is the default on VPN virtual servers.

According to the NVD record, NetScaler ADC and NetScaler Gateway builds before 14.1-73.37 and before 13.1-64.23 are affected, as are NetScaler ADC 14.1 FIPS builds before 14.1-73.37 FIPS and FIPS and NDcPP builds before 13.1-37.279. Citrix, which assigned the CVE, scores it 9.5 under CVSS 4.0: network attack vector, high attack complexity, no privileges or user interaction required, and high impact to confidentiality, integrity and availability.

Citrix has observed exploitation.

Citrix's bulletin says exploits of CVE-2026-88772 and CVE-2026-88771, a second NetScaler flaw CISA added to the catalog the same day, have been observed on unmitigated deployments. The bulletin covers eight CVEs in total, CVE-2026-88771 through CVE-2026-88778, and urges customers to install the updated builds as soon as possible.

CISA set a September 30, 2026 deadline.

The required action is to apply mitigations in accordance with vendor instructions, in line with CISA's BOD 26-04 guidance and its forensics triage requirements, or to follow BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. CISA marks forensic triage as required for this entry, and its notes say running the provided indicators of compromise in the NetScaler console may help identify signs of exploitation. Whether the flaw has been used in ransomware campaigns is listed as unknown.