CVE-2026-88779 · High · CISA KEV

Citrix NetScaler DoS vulnerability actively exploited in the wild (KEV)

Threat Engine Auto-Feed · data current as of 2026-10-06

A denial-of-service vulnerability in Citrix NetScaler ADC and Gateway is being actively exploited in the wild, as confirmed by its inclusion in CISA's KEV catalog. While specific impact details are unknown, successful exploitation could disrupt critical network services. Organizations using affected Citrix NetScaler products should prioritize detection and mitigation.

  • CVSS:
  • EPSS percentile: 0.4651
  • Exploitation pressure: 53/100 (High)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 47th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability involves an 'improper restriction of operations within the bounds of a memory buffer.' This means the software attempts to perform an action on data outside the designated memory area it's allowed to access. This can lead to unexpected program behavior, including crashes or unresponsiveness, resulting in a denial of service.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations relying on Citrix NetScaler ADC or Gateway for critical network services (e.g., load balancing, VPN, application delivery)
  • Financial services organizations (targeted by FIN7, LockBit affiliates, APT38)
  • Technology sector organizations (targeted by APT29, Scattered Spider)

Misconfigurations that escalate it

    High-impact scenarios

    • Disruption of critical network services, leading to operational downtime and unavailability of applications or remote access.
    • Impact on business continuity due to the denial of service affecting core infrastructure components.

    Likely adversaries

    • FIN7 — Financial services (Assessed)
    • LockBit affiliates — Financial services (Assessed)
    • APT38 (Lazarus) — Financial services (Assessed)
    • APT29 (Cozy Bear) — Technology (Assessed)
    • Scattered Spider — Technology (Assessed)

    What to do (defensive)

    Detect

    • Monitor Citrix NetScaler ADC and Gateway logs for unusual activity, crashes, or unexpected restarts.
    • Implement network monitoring to detect abnormal traffic patterns or service interruptions related to NetScaler devices.

    Contain

    • Isolate affected Citrix NetScaler devices from the network if signs of exploitation are detected to prevent further impact.
    • Implement rate limiting or access control lists (ACLs) on network devices to restrict traffic to NetScaler instances if a DoS attack is suspected.

    Patch

    • Apply vendor-provided security patches for Citrix NetScaler ADC and Gateway as soon as they become available.

    Frontier verdict — High

    High priority due to active exploitation in the wild (CISA KEV) and potential for critical service disruption.

    For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.