CVE-2026-88779

HighCVSS 7.5/10Known exploited (CISA KEV)Last modified Oct 5, 2026

Description

Vulnerability in NetScaler ADC and NetScaler Gateway.

This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
NetScaler	ADC	< 14.1-73.41; < 13.1-64.28; < 14.1-73.41 FIPS; < 13.1-37.282
NetScaler	Gateway	< 14.1-73.41; < 13.1-64.28

References

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174Vendor Advisory
https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/Mitigation, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88779US Government Resource

Timeline

Published: Oct 4, 2026
Last modified: Oct 5, 2026
Added to CISA KEV: Oct 4, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-88787.5Version 3.0.7 of the Securly Chrome Extension exposes multiple publicly accessible endpoints that allow unauthenticated access to sensitive CVE-2026-887826.8The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a CVE-2026-887838.8The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so t CVE-2026-887847.5The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting lin CVE-2026-887854.7The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL quer CVE-2026-887886.8The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputting them within a fro CVE-2026-887898.6Improper Restriction of XML External Entity Reference in the XSLT support extension (camel-quarkus-support-xalan) in Apache Camel Quarkus fr CVE-2026-88797.5Version 3.0.7 of the Securly Chrome Extension dynamically registers content13.min.js as a content script via chrome.scripting.registerConten CVE-2026-887904.8A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/elec CVE-2026-887913.4The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly validate the redirect destination when a wildcard redirect rule to CVE-2026-887928.8The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionar CVE-2026-887938.8The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a