CISA adds actively exploited Citrix NetScaler zero day to KEV catalog

The Cybersecurity and Infrastructure Security Agency has added a Citrix NetScaler flaw to its Known Exploited Vulnerabilities catalog on Sunday, Help Net Security and Security Affairs reported. The flaw, identified as CVE-2026-88779, is a memory overflow vulnerability that affects Citrix NetScaler ADC and Gateway appliances. [1][7][10]

Help Net Security and TechNadu report that the zero-day flaw is being actively exploited in targeted attacks. According to Citrix, the vulnerability can lead to a denial of service that leaves services unavailable if triggered repeatedly. As FTMQ Security reported earlier, researchers are investigating whether the security issue can also allow remote code execution. [1][2][10]

NetScaler functions as an application delivery controller that offers load balancing and traffic management features for concurrent user sessions. As FTMQ Security reported earlier, Citrix has released emergency security patches to address the issue in unmitigated deployments. [9][10]

The warning from CISA follows reports from CyberSecurityNews and eSecurity Planet indicating that the vulnerability has been actively targeted in ongoing attacks against unpatched systems. [3][4][5][6]