CISA Adds Citrix NetScaler Memory Buffer Vulnerability to Known Exploited Catalog

Washington, D.C. – The Cybersecurity and Infrastructure Security Agency (CISA) announced on October 4, 2026, the addition of one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog. Tracked as CVE-2026-88779, the flaw affects Citrix NetScaler products and involves an improper restriction of operations within the bounds of a memory buffer.

CISA stated that there is evidence of active exploitation of this vulnerability in the wild, which satisfies the criteria for KEV Catalog inclusion. The agency noted that this type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. The directive requires these agencies to prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets that grant total control of the asset post-exploitation. BOD 26-04 also establishes expectations for agencies to check whether threat actors compromised the system before a patch was applied.

While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

Organizations aware of an exploited vulnerability not currently listed in the KEV Catalog are encouraged to submit it for potential addition through CISA’s KEV Nomination Form. Potential additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.