Skip to content
Sign in
CVE-2026-887729.5Critical

CVE-2026-88772: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Citrix NetScaler · ADC

Vendor fix available · Affected: Citrix NetScaler ADC · Exploitation: in CISA KEV since 27 Sep

ExploitationIn CISA KEV

  1. In CISA KEVCISA KEV catalogue27 Sep
  2. Exploited (reported): not seen
  3. Scanning observed: not seen
  4. Proof of concept public4 public GitHub repositories (unverified), listed by PoC-in-GitHub27 Sep
  5. Not established: not seen
76.6%probability of exploitation in the next 30 days
99th percentile
050100

Higher than 99% of scored CVEs

9.5CriticalCVSS 4.0
LowCrit.

Federal deadline

CISA KEV · added 27 Sep · catalogue entry

Passed 41 days ago

DescriptionNVD

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service

What changed

  1. PoC-in-GitHub lists 4 public GitHub repositories (unverified) PoC-in-GitHub
  2. CISA added it to the KEV catalogue CISA

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Coverage29 articles · 13 outlets

One row per outlet, in order of first report. First in our coverage: SecurityOnline, 27 Sep.

Full timeline
Quiet for 3 weekslast report 19 Oct29 articles13 outlets
27 Sep · SecurityOnline first22 Oct30 OctNow
  • Sun 27 Sep, 18:30 UTC. SecurityOnline, first report. Citrix NetScaler Zero Days Exploited to Attack VPN Appliances. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 18:30 UTC. Security Affairs, its first report on the story. Citrix NetScaler Zero Days Exploited Against Unpatched Systems. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 20:47 UTC. CISA, its first report on the story. CISA Flags Actively Exploited Citrix NetScaler Flaws for Urgent Action. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 20:47 UTC. CISA. CISA Warns Attackers Are Exploiting Critical Citrix NetScaler Zero-Days. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 23:01 UTC. CISA. CISA Warns Attackers Are Exploiting Critical Citrix NetScaler Flaw. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:00 UTC. SecurityWeek, its first report on the story. Citrix Patches NetScaler Zero Days Exploited in Global Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:00 UTC. SOCRadar, its first report on the story. Citrix Patches NetScaler Zero Days Exploited in Global Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:35 UTC. Infosecurity, its first report on the story. Citrix NetScaler Zero Days Exploited in Attacks, Patch Now. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 09:47 UTC. Security Affairs. CISA Warns of Active Exploitation in Critical Citrix NetScaler Flaws. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 12:07 UTC. Rapid7, its first report on the story. Citrix NetScaler Zero Days Expose Appliances to Active RCE Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 13:21 UTC. NCSC, its first report on the story. UK Cyber Agency Urges Action on Exploited Citrix NetScaler Flaws. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 14:30 UTC. The Hacker News, its first report on the story. Hackers Exploit Citrix NetScaler Flaws as Forgotten Assets Fuel Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 15:30 UTC. Unit 42, its first report on the story. Citrix NetScaler Zero Days Exploited as 50,000 Systems Exposed. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 08:00 UTC. SecurityOnline. Critical NetScaler Flaw Lets Attackers Run Root Commands Unauthenticated. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 07:13 UTC. The Hacker News. NetScaler Flaw Exploited to Gain Root Access Before Authentication. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 08:25 UTC. Security Affairs. Citrix NetScaler Zero Day Gives Attackers Tunnels Into Internal Networks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 10:13 UTC. The Hacker News. Attackers Exploit Citrix NetScaler Flaw to Deploy Root Web Shells. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 13:16 UTC. SecurityWeek. Citrix NetScaler Zero Days Let Attackers Steal Credentials Through Web Shells. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 02:14 UTC. SecurityOnline. Active NetScaler Zero Days Expose Devices to Remote Code Execution. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 04:38 UTC. The Hacker News. Attackers Exploit Critical NetScaler Flaw to Steal Configurations. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 10:28 UTC. SecurityOnline. Citrix NetScaler Zero Day Lets Attackers Seize Root Access Without Passwords. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 12:31 UTC. DataBreaches, its first report on the story. Citrix NetScaler Zero Days Exploited Against 50,000 Devices. Cites a CVE in CISA KEV.
  • Fri 2 Oct, 17:05 UTC. Dark Reading, its first report on the story. Citrix NetScaler Zero Days Exploited as Vendors Take Different Risks. Cites a CVE in CISA KEV.
  • Fri 2 Oct, 22:22 UTC. SecurityOnline. Citrix NetScaler Reboots Persist as SAML Flaw Fix Remains Pending. Cites a CVE in CISA KEV.
  • Mon 5 Oct, 05:53 UTC. SecurityWeek. Citrix NetScaler Zero Day Exploited Days After PitScaler Fixes. Cites a CVE in CISA KEV.
  • Mon 5 Oct, 13:18 UTC. The Hacker News. Credential sprawl is outpacing security teams’ ability to see it. Cites a CVE in CISA KEV.
  • Thu 8 Oct, 18:48 UTC. The Hacker News. ThreatsDay Round-Up Exposes Rogue Affiliates and Leaky Attack Tools. Cites a CVE in CISA KEV.
  • Sat 10 Oct, 11:48 UTC. The Hacker News. Enterprise Software’s Hidden AI Agents Create a Security Blind Spot. Cites a CVE in CISA KEV.
  • Mon 19 Oct, 13:24 UTC. Cloudflare, its first report on the story. Citrix NetScaler Flaw Sparks Attacks, Prompting Urgent Patching. Cites a CVE in CISA KEV.
All coveragerunning total29SecurityOnl…5Security Af…3CISA3SecurityWeek3SOCRadar1Infosecurity1Rapid71NCSC1The Hacker…74 more outlets428 Sep13 Oct28 OctNow
  • First report
  • Article
  • Official notice
  • Running total

Added to CISA KEV

Show as table
29 articles about CVE-2026-88772 from 13 outlets
Published (UTC)OutletHeadline
27 Sep 18:30SecurityOnlineCitrix NetScaler Zero Days Exploited to Attack VPN Appliances
27 Sep 18:30Security AffairsCitrix NetScaler Zero Days Exploited Against Unpatched Systems
27 Sep 20:47CISACISA Flags Actively Exploited Citrix NetScaler Flaws for Urgent Action
27 Sep 20:47CISACISA Warns Attackers Are Exploiting Critical Citrix NetScaler Zero-Days
27 Sep 23:01CISACISA Warns Attackers Are Exploiting Critical Citrix NetScaler Flaw
28 Sep 08:00SecurityWeekCitrix Patches NetScaler Zero Days Exploited in Global Attacks
28 Sep 08:00SOCRadarCitrix Patches NetScaler Zero Days Exploited in Global Attacks
28 Sep 08:35InfosecurityCitrix NetScaler Zero Days Exploited in Attacks, Patch Now
28 Sep 09:47Security AffairsCISA Warns of Active Exploitation in Critical Citrix NetScaler Flaws
28 Sep 12:07Rapid7Citrix NetScaler Zero Days Expose Appliances to Active RCE Attacks
28 Sep 13:21NCSCUK Cyber Agency Urges Action on Exploited Citrix NetScaler Flaws
28 Sep 14:30The Hacker NewsHackers Exploit Citrix NetScaler Flaws as Forgotten Assets Fuel Attacks
28 Sep 15:30Unit 42Citrix NetScaler Zero Days Exploited as 50,000 Systems Exposed
29 Sep 08:00SecurityOnlineCritical NetScaler Flaw Lets Attackers Run Root Commands Unauthenticated
30 Sep 07:13The Hacker NewsNetScaler Flaw Exploited to Gain Root Access Before Authentication
30 Sep 08:25Security AffairsCitrix NetScaler Zero Day Gives Attackers Tunnels Into Internal Networks
30 Sep 10:13The Hacker NewsAttackers Exploit Citrix NetScaler Flaw to Deploy Root Web Shells
30 Sep 13:16SecurityWeekCitrix NetScaler Zero Days Let Attackers Steal Credentials Through Web Shells
1 Oct 02:14SecurityOnlineActive NetScaler Zero Days Expose Devices to Remote Code Execution
1 Oct 04:38The Hacker NewsAttackers Exploit Critical NetScaler Flaw to Steal Configurations
1 Oct 10:28SecurityOnlineCitrix NetScaler Zero Day Lets Attackers Seize Root Access Without Passwords
1 Oct 12:31DataBreachesCitrix NetScaler Zero Days Exploited Against 50,000 Devices
2 Oct 17:05Dark ReadingCitrix NetScaler Zero Days Exploited as Vendors Take Different Risks
2 Oct 22:22SecurityOnlineCitrix NetScaler Reboots Persist as SAML Flaw Fix Remains Pending
5 Oct 05:53SecurityWeekCitrix NetScaler Zero Day Exploited Days After PitScaler Fixes
5 Oct 13:18The Hacker NewsCredential sprawl is outpacing security teams’ ability to see it
8 Oct 18:48The Hacker NewsThreatsDay Round-Up Exposes Rogue Affiliates and Leaky Attack Tools
10 Oct 11:48The Hacker NewsEnterprise Software’s Hidden AI Agents Create a Security Blind Spot
19 Oct 13:24CloudflareCitrix NetScaler Flaw Sparks Attacks, Prompting Urgent Patching
  1. Citrix NetScaler Flaw Sparks Attacks, Prompting Urgent Patching
    Cloudflare · mentions it in passing
  2. Enterprise Software’s Hidden AI Agents Create a Security Blind Spot
    The Hacker News
  3. ThreatsDay Round-Up Exposes Rogue Affiliates and Leaky Attack Tools
    The Hacker News
  4. Credential sprawl is outpacing security teams’ ability to see it
    The Hacker News
  5. Citrix NetScaler Zero Day Exploited Days After PitScaler Fixes
    SecurityWeek · mentions it in passing
  6. Citrix NetScaler Reboots Persist as SAML Flaw Fix Remains Pending
    SecurityOnline · mentions it in passing
  7. Citrix NetScaler Zero Days Exploited as Vendors Take Different Risks
    Dark Reading · mentions it in passing
  8. Citrix NetScaler Zero Days Exploited Against 50,000 Devices
    DataBreaches · mentions it in passing
Show 21 more

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in