# Citrix NetScaler buffer overflow actively exploited

Published: 2026-10-04 · Severity: high · Sectors: government-national
Canonical: https://vorant.io/reports/ca4f09ed-02ad-5097-b2e6-c9210a7c39ef/citrix-netscaler-buffer-overflow-actively-exploited

> CVE-2026-88779 buffer overflow in Citrix NetScaler is being exploited in the wild; federal agencies must prioritize patching.

CISA has added CVE-2026-88779 to its Known Exploited Vulnerabilities (KEV) Catalog based on confirmed evidence of active exploitation. The vulnerability is an improper restriction of operations within memory buffer bounds in Citrix NetScaler, a frequent attack vector that can lead to complete system compromise. This designation reflects the severity and immediate risk posed by the flaw.

Federal Civilian Executive Branch (FCEB) agencies are required under Binding Operational Directive (BOD) 26-04 to prioritize rapid remediation of this and other KEV Catalog vulnerabilities on publicly exposed assets, as successful exploitation grants total control of the affected system. Agencies must also determine whether systems were compromised before patches were applied. While BOD 26-04 applies specifically to federal agencies, CISA recommends all organizations adopt risk-based vulnerability management and treat KEV Catalog entries as high-priority patching targets.

## Mentioned in this report

- Vulnerabilities: CVE-2026-88779 (KEV)

Source reporting: https://www.cisa.gov/news-events/alerts/2026/10/04/cisa-adds-one-known-exploited-vulnerability-catalog

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/ca4f09ed-02ad-5097-b2e6-c9210a7c39ef/citrix-netscaler-buffer-overflow-actively-exploited.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup