> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Vulnérabilité dans Citrix NetScaler ADC et Gateway (05 octobre 2026) - URL: https://f4n6.co.uk/security-feed/vulnerabilite-dans-citrix-netscaler-adc-et-gateway-05-octobre-2026/ - Published: 2026-10-07T09:45:40.000Z - Updated: 2026-10-07T09:45:40.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-88779 ## 1\. Executive summary CVE-2026-88779 is a memory buffer vulnerability in Citrix NetScaler ADC and NetScaler Gateway that allows an unauthenticated remote attacker to cause a denial of service. NVD scores it CVSS 8.7 HIGH (CWE-119), and CISA added it to the Known Exploited Vulnerabilities catalogue on 2026-10-04, confirming exploitation in the wild; EPSS sits at 1%. ANSSI, BSI and the UK NCSC have all issued warnings, and the CISA KEV remediation due date of 2026-10-07 has already passed. Any EMEA financial services firm exposing a NetScaler ADC or Gateway management or traffic interface to the internet should treat this as an active, in-progress exploitation event rather than a patch-cycle item. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17: ICT-related incident management process | CISA KEV listing on 2026-10-04 confirms active exploitation of an internet-facing component in the firm's own estate, not a third party's | Firms must run this through their documented incident management process, including detection, containment and root-cause handling, rather than treating it as routine patch management | | DORA Art. 19: reporting of major ICT-related incidents to competent authorities | A confirmed exploited vulnerability in an internet-facing NetScaler ADC or Gateway may meet the major-incident classification threshold under Art. 18 | If the incident is classified as major, the reporting clock to the competent authority starts from classification, not from discovery | | NIS2 Art. 23: incident reporting obligations | Same trigger: active exploitation of an internet-facing network component in scope of the entity's NIS2 obligations | Early warning and incident notification timelines apply if the entity is in NIS2 scope and the incident meets the significance threshold | DORA Art. 18 is the classification gate for the Art. 19 row and is not listed separately because it does not change the action. No article is engaged on the basis of the vulnerability existing alone. ## 3\. Technical analysis & attack chain The confirmed chain is short and the source material does not support more detail than this. 1. An unauthenticated remote attacker sends crafted input to an exposed NetScaler ADC or Gateway interface. 2. The input triggers improper restriction of operations within the bounds of a memory buffer (CWE-119), corrupting memory handling in the affected component. 3. The result is a denial of service against the appliance. CISA added CVE-2026-88779 to KEV on 2026-10-04 with a remediation due date of 2026-10-07, which is the authoritative confirmation that the flaw is being exploited. CISA records known ransomware campaign use as "Unknown", so there is no basis to describe this as ransomware-associated. The KEV entry directs agencies to apply mitigations per vendor instructions and to follow BOD 26-04, including evaluating each asset's internet exposure; the same exposure question is the one that matters for a financial services estate. Affected versions, from the ANSSI advisory: - NetScaler ADC 13.1-FIPS earlier than 13.1-NDcPP 13.1-37.282 - NetScaler ADC 13.1.x earlier than 13.1-64.28 - NetScaler ADC 14.1-FIPS earlier than 14.1-73.41 FIPS - NetScaler ADC 14.1.x earlier than 14.1-73.41 - NetScaler Gateway 13.1.x earlier than 13.1-64.28 - NetScaler Gateway 14.1.x earlier than 14.1-73.41 The vendor fix is Citrix security bulletin CTX697174, published 2026-10-04\. ANSSI's own remediation line is to refer to the vendor bulletin for patches; no workaround or configuration-level mitigation is given in the sources. Two caveats on scope. First, the ANSSI alert of 28 September 2026 (CERTFR-2026-ALE-011) concerns a separate set of NetScaler vulnerabilities, CVE-2026-88771 and CVE-2026-88772, which allow unauthenticated remote code execution. Those are not the CVE in this advisory and the sources do not state that they are exploited. They are worth checking on the same appliances because they affect the same version ranges, but do not conflate them with CVE-2026-88779\. Second, the sources give no exploitation detail beyond "denial of service": no observed payload, no post-exploitation behaviour, no command-and-control, no lateral movement and no data access. Any claim that this vulnerability has been used for code execution, persistence or data theft is not supported by the material here. ## 4\. Mitigation & containment P1 (within 24 hours) - Inventory every NetScaler ADC and NetScaler Gateway instance, including FIPS builds, and record which are reachable from the internet. CISA's KEV guidance makes internet exposure the deciding factor for urgency. - Patch to the fixed builds: 13.1-64.28 or later for 13.1.x, 14.1-73.41 or later for 14.1.x, 13.1-NDcPP 13.1-37.282 or later for 13.1-FIPS, and 14.1-73.41 FIPS or later for 14.1-FIPS. Follow Citrix bulletin CTX697174. - Where patching cannot complete inside 24 hours, remove internet reachability from the affected interface. The sources give no vendor workaround, so exposure reduction is the only available interim control. - Treat any NetScaler appliance that has been internet-facing since before 2026-10-04 as potentially targeted. Pull authentication logs, management interface access logs and appliance crash or restart records for that window. P2 (within 72 hours) - Check the same appliances for the CVE-2026-88771 and CVE-2026-88772 version exposure from the 28 September ANSSI alert, since the affected version ranges overlap and those two allow unauthenticated remote code execution. - Confirm that management interfaces are not internet-facing as a standing configuration, not just during this event. - Verify that NetScaler instances are covered by the firm's incident management process under DORA Art. 17, and that any confirmed exploitation has been assessed against the major-incident classification criteria. P3 (within 7 days) - Add NetScaler ADC and Gateway to the asset inventory feeding third-party and concentration risk assessment where the appliances are vendor-supported components in a critical service path. - Review whether the KEV due date of 2026-10-07 was met internally; if it was missed, record why and fix the intake path from KEV to change management. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The sources provide no hashes, domains, IP addresses, file paths, registry keys or process artefacts. What is available is exposure and version data, which is not an atomic indicator and does not belong in the copyable block. Behavioural indicators | behaviour | where to observe | confidence | | -------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------- | | Denial of service against NetScaler ADC or Gateway, consistent with memory buffer corruption | Appliance availability monitoring, crash and restart logs, service health dashboards | High for the vulnerability class; the sources do not describe the specific observable signature | | Unauthenticated requests to an exposed NetScaler interface preceding an availability loss | NetScaler access and web logs, upstream load balancer or WAF logs | Medium; inferred from "unauthenticated remote" and "denial of service", not stated in the sources | ## 6\. Detection Insufficient indicators to author detection rules. The sources contain no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file paths, registry keys or hard-coded values. A YARA or Sigma rule built from the CVE identifier, the product name or the vendor bulletin number would match reporting about the vulnerability rather than exploitation of it, so none is emitted. Detection effort should go into availability monitoring and access logging on the affected appliances, as set out in §5. ## CVE assessment 1 referenced CVE — **1 actively exploited (CISA KEV)** | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | -------- | ---------------- | ---- | ------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-88779](https://nvd.nist.gov/vuln/detail/CVE-2026-88779?ref=f4n6.co.uk) | 8.7 High | ⚠ KEV 2026-10-04 | 1% | Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.… | ## 7\. Sources - ANSSI France CERT, Vulnérabilité dans Citrix NetScaler ADC et Gateway (CERTFR-2026-AVI-1263), https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1263/, 2026-10-05 - CISA Known Exploited Vulnerabilities, CVE-2026-88779, Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability, https://nvd.nist.gov/vuln/detail/CVE-2026-88779 - Citrix, NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-88779 (CTX697174), https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174&articleURL=Citrix\_NetScaler\_ADC\_and\_Citrix\_NetScaler\_Gateway\_Security\_Bulletin\_for\_CVE\_2026\_88779, 2026-10-04 - ANSSI France CERT, Multiples vulnérabilités dans Citrix NetScaler ADC et Gateway (CERTFR-2026-AVI-1235), https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1235/, 2026-09-28 - ANSSI France CERT, Multiples vulnérabilités dans Citrix NetScaler ADC et Gateway (CERTFR-2026-ALE-011), https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/, 2026-09-28 - BSI Germany, Citrix NetScaler ADC und Gateway: Schwachstelle ermöglicht Denial of Service (WID-SEC-2026-3719), https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3719 - NCSC UK, Exploitation of vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway, https://www.ncsc.gov.uk/news/exploitation-of-vulnerabilities-affecting-citrix-netscaler-adc-and-citrix-netscaler-gateway ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-88779 as CVSS 8.7 HIGH with confirmed active exploitation per CISA KEV, and treats the KEV remediation due date of 2026-10-07 as already breached for any client that has not patched. The impact is availability, not confidentiality or integrity, but on an internet-facing NetScaler ADC or Gateway that sits in front of authentication and application delivery, an availability loss is a service outage with downstream customer impact. The exploitation detail is thin: the sources confirm exploitation and describe the outcome as denial of service, and nothing more. We have no evidence of code execution, persistence or data theft from this CVE, and we will not assert any. Attribution is not possible from the material provided; no actor is named in any source and no MITRE ATT&CK profile applies. We will monitor the Citrix bulletin and the KEV entry for a revised CVSS, an added workaround, or any change to the ransomware-use field, and we will issue a follow-up if the exploitation picture changes. Clients who cannot confirm patch state on all NetScaler ADC and Gateway instances should contact us today. --- [Read the original source →](https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1263/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*