CVE-2026-88779 in citrix netscaler application delivery controller
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.
Affected software: citrix netscaler application delivery controller, citrix netscaler gateway
Scores
- CVSS: 8.7 (high)
- EPSS: 11.39% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2026-10-04
- Published: 2026-10-04
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Upgrade Citrix NetScaler ADC and Gateway for the memory buffer DoS (CVE-2026-88779)
Patch or upgrade. Upgrade NetScaler ADC and NetScaler Gateway to a build Citrix lists as fixed in bulletin CTX697174. This stops attackers from crashing the appliance through the memory buffer flaw.
Applies to: Citrix NetScaler ADC and NetScaler Gateway builds listed as affected in CTX697174, customer-managed.
- List every NetScaler ADC and Gateway appliance and check the build with 'show ns version'.
- Find the fixed build for your release line in CTX697174.
- Back up the configuration ('save ns config', copy /nsconfig/ns.conf).
- On an HA pair, upgrade the secondary first, fail over with 'force ha failover', then upgrade the former primary (System, Upgrade Wizard).
- Confirm the build with 'show ns version' on every node.
- Move end of life releases (12.1, 13.0) to a supported fixed release.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.