{ "schemaVersion": 1, "site": "https://cveboard.org", "generatedAt": "2026-10-23T19:16:54.834Z", "lastRun": "2026-10-23T19:01:02.861Z", "liveDays": 14, "filters": { "kind": null, "exploited": false, "severity": null, "ecosystems": [], "tag": "citrix" }, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "incidents": [ { "id": "cve-2026-88779", "url": "https://cveboard.org/i/cve-2026-88779", "urlPt": "https://cveboard.org/pt/i/cve-2026-88779", "json": "https://cveboard.org/i/cve-2026-88779.json", "kind": "vuln", "live": false, "knownExploited": true, "severity": "high", "title": "Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability", "summary": "Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.", "titlePt": "Vulnerabilidade de restrição inadequada de operações dentro dos limites de um buffer de memória no Citrix NetScaler", "summaryPt": "Citrix NetScaler ADC (anteriormente Citrix ADC) e Citrix NetScaler Gateway (anteriormente Citrix Gateway) contêm uma vulnerabilidade de restrição inadequada de operações dentro dos limites de um buffer de memória que pode permitir uma negação de serviço.", "affected": [ { "vendor": "NetScaler", "product": "ADC", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "lessThan": "14.1-73.41", "lessThanOrEqual": null }, { "version": "0", "status": "affected", "lessThan": "13.1-64.28", "lessThanOrEqual": null }, { "version": "0", "status": "affected", "lessThan": "14.1-73.41 FIPS", "lessThanOrEqual": null }, { "version": "0", "status": "affected", "lessThan": "13.1-37.282", "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] }, { "vendor": "NetScaler", "product": "Gateway", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "lessThan": "14.1-73.41", "lessThanOrEqual": null }, { "version": "0", "status": "affected", "lessThan": "13.1-64.28", "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "14.1-73.41" ] } ], "omitted": 0, "references": [ { "url": "https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" } ], "ssvc": { "exploitation": "active", "automatable": "yes", "impact": "partial", "at": "2026-10-04T00:00:00.000Z" }, "fix": "listed", "tags": [ "citrix" ], "cves": [ "CVE-2026-88779" ], "ghsa": null, "cvss": { "score": 8.7, "version": "4.0", "by": "NetScaler" }, "epss": { "percentage": 0.00592, "percentile": 0.47623, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [], "vendor": "Citrix", "product": "NetScaler", "kev": { "dateAdded": "2026-10-04", "dueDate": "2026-10-07", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.", "ransomware": false }, "breach": null, "retracted": false, "sources": [ { "label": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-88779" } ], "publishedAt": "2026-10-04T00:00:00.000Z", "updatedAt": "2026-10-04T00:00:00.000Z" }, { "id": "cve-2026-88772", "url": "https://cveboard.org/i/cve-2026-88772", "urlPt": "https://cveboard.org/pt/i/cve-2026-88772", "json": "https://cveboard.org/i/cve-2026-88772.json", "kind": "vuln", "live": false, "knownExploited": true, "severity": "critical", "title": "Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability", "summary": "Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service", "titlePt": "Vulnerabilidade de restrição inadequada de operações dentro dos limites de um buffer de memória do Citrix NetScaler", "summaryPt": "Citrix NetScaler ADC e Citrix NetScaler Gateway contêm uma vulnerabilidade de restrição inadequada de operações dentro dos limites de um buffer de memória que pode permitir a execução remota de código ou negação de serviço", "affected": [ { "vendor": "Citrix NetScaler", "product": "ADC", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "lessThan": "14.1-73.37", "lessThanOrEqual": null }, { "version": "0", "status": "affected", "lessThan": "13.1-64.23", "lessThanOrEqual": null }, { "version": "0", "status": "affected", "lessThan": "14.1-73.37 FIPS", "lessThanOrEqual": null }, { "version": "0", "status": "affected", "lessThan": "13.1.37.279 FIPS and NDcPP", "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] }, { "vendor": "Citrix NetScaler", "product": "Gateway", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "lessThan": "14.1-73.37", "lessThanOrEqual": null }, { "version": "0", "status": "affected", "lessThan": "13.1-64.23", "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "14.1-73.37" ] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" } ], "ssvc": { "exploitation": "active", "automatable": "no", "impact": "total", "at": "2026-09-27T00:00:00.000Z" }, "fix": "listed", "tags": [ "citrix" ], "cves": [ "CVE-2026-88772" ], "ghsa": null, "cvss": { "score": 9.5, "version": "4.0", "by": "NetScaler" }, "epss": { "percentage": 0.05305, "percentile": 0.92568, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [], "vendor": "Citrix", "product": "NetScaler", "kev": { "dateAdded": "2026-09-27", "dueDate": "2026-09-30", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.", "ransomware": false }, "breach": null, "retracted": false, "sources": [ { "label": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-88772" } ], "publishedAt": "2026-09-27T00:00:00.000Z", "updatedAt": "2026-09-27T00:00:00.000Z" }, { "id": "cve-2026-88771", "url": "https://cveboard.org/i/cve-2026-88771", "urlPt": "https://cveboard.org/pt/i/cve-2026-88771", "json": "https://cveboard.org/i/cve-2026-88771.json", "kind": "vuln", "live": false, "knownExploited": true, "severity": "critical", "title": "Citrix NetScaler Improper Input Validation Vulnerability", "summary": "Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.", "titlePt": "Vulnerabilidade de validação inadequada de entrada do Citrix NetScaler", "summaryPt": "Citrix NetScaler ADC e Citrix NetScaler Gateway contêm uma vulnerabilidade de validação inadequada de entrada que poderia permitir que um atacante não autenticado execute comandos arbitrários.", "affected": [ { "vendor": "Citrix NetScaler", "product": "ADC", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "lessThan": "14.1-73.37", "lessThanOrEqual": null }, { "version": "0", "status": "affected", "lessThan": "13.1-64.23", "lessThanOrEqual": null }, { "version": "0", "status": "affected", "lessThan": "14.1-73.37 FIPS", "lessThanOrEqual": null }, { "version": "0", "status": "affected", "lessThan": "13.1.37.279 FIPS and NDcPP", "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] }, { "vendor": "Citrix NetScaler", "product": "Gateway", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "lessThan": "14.1-73.37", "lessThanOrEqual": null }, { "version": "0", "status": "affected", "lessThan": "13.1-64.23", "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "14.1-73.37" ] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-20", "name": "Improper input validation" } ], "ssvc": { "exploitation": "active", "automatable": "yes", "impact": "total", "at": "2026-09-27T00:00:00.000Z" }, "fix": "listed", "tags": [ "citrix" ], "cves": [ "CVE-2026-88771" ], "ghsa": null, "cvss": { "score": 9.5, "version": "4.0", "by": "NetScaler" }, "epss": { "percentage": 0.04722, "percentile": 0.91805, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [], "vendor": "Citrix", "product": "NetScaler", "kev": { "dateAdded": "2026-09-27", "dueDate": "2026-09-30", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.", "ransomware": false }, "breach": null, "retracted": false, "sources": [ { "label": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-88771" } ], "publishedAt": "2026-09-27T00:00:00.000Z", "updatedAt": "2026-09-27T00:00:00.000Z" } ], "tag": { "tag": "citrix", "name": "Citrix", "kev": { "name": "Citrix", "total": 27, "last": "2026-10-04" } } }