Page generated: 10 Nov 2026, 19:41 UTC
← Dashboard

CVE-2026-88779

Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.

CVSS 8.7 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
3.6/10
REALITY · THREAT PRIORITY
8.4/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 8.7: +1.30
  • Fresh EPSS: 11.39%: +0.06

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 35 documents and public datasets.

Hype components

Headline sample (25%)
50/100
Press, 30 days (60%)
40/100
Grounded branding (15%)
0/100
HYPE TOTAL36/100

Sources and documents

Rapid7 Cybersecurity Blog
Press · 19 Oct 2026, 15:11 · Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
Rapid7
Press · 19 Oct 2026, 07:00 · NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779 - Rapid7
iTnews
Press · 11 Oct 2026, 13:29 · NetScaler builds that fixed zero-days carry critical flaw, too - iTnews
The Register
Press · 09 Oct 2026, 07:00 · Citrix gives NetScaler admins another critical reason to patch - The Register
The Hacker News
Press · 09 Oct 2026, 07:00 · Citrix Patches Critical NetScaler Flaw That Could Enable RCE in SAML Deployments - The Hacker News
See all 35 source documents
Cisco Talos Blog
Press · 08 Oct 2026, 18:00 · Making sure the checks get printed
https://tech-insider.org/
Press · 07 Oct 2026, 07:00 · Citrix NetScaler Hit by 3rd Zero-Day, CVE-2026-88779 [2026] - https://tech-insider.org/
watchTowr
Press · 07 Oct 2026, 07:00 · Post-Exploitation Analysis & Artifacts – Citrix NetScaler CVE-2026-88771 - watchTowr
SOCRadar
Press · 06 Oct 2026, 07:00 · CVE-2026-88779: Citrix NetScaler Zero-Day - SOCRadar
Field Effect
Press · 06 Oct 2026, 07:00 · Citrix patches another exploited NetScaler vulnerability - Field Effect
BankInfoSecurity
Press · 05 Oct 2026, 18:18 · Citrix Patches Yet Another Under-Fire Zero-Day in NetScaler - BankInfoSecurity
"CVE-2026-88779" - Google News
Press · 05 Oct 2026, 17:13 · Warning: CVE-2026-88779 affects NetScaler ADC and NetScaler Gateway, allowing remote attackers to cause denial of service. Patch Immediately! - CCB Belgium
The Hacker News
Press · 05 Oct 2026, 07:00 · ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests - The Hacker News
"CVE-2026-88779" - Google News
Press · 05 Oct 2026, 07:00 · Citrix NetScaler SAML 0-Day Vulnerability Actively Exploited in Attacks - CyberSecurityNews
"CVE-2026-88779" - Google News
Press · 05 Oct 2026, 07:00 · Citrix NetScaler SAML Vulnerability Enables Unauthenticated Remote DoS Attacks - GBHackers News
SC Media
Press · 05 Oct 2026, 07:00 · New Citrix Netscaler zero-day exploited just days after recent attacks | news - SC Media
Infosecurity Magazine
Press · 05 Oct 2026, 07:00 · Citrix NetScaler Targeted Via New Zero Day - Infosecurity Magazine
Hong Kong Computer Emergency Response Team Coordination Centre
Press · 05 Oct 2026, 07:00 · Citrix Products Denial of Service Vulnerability - Hong Kong Computer Emergency Response Team Coordination Centre
The Record from Recorded Future News
Press · 05 Oct 2026, 07:00 · US, Australia warn of latest Citrix vulnerability after NetScaler advisory - The Record from Recorded Future News
The Register
Press · 05 Oct 2026, 07:00 · Citrix NetScaler security snafus get even worse amid more 0-day reports - The Register
CSO Online
Press · 05 Oct 2026, 07:00 · Citrix warns of actively exploited NetScaler flaw days after zero-day patch rush - CSO Online
Help Net Security
Press · 05 Oct 2026, 07:00 · CISA flags new exploited NetScaler flaw as attackers crash appliances (CVE-2026-88779) - Help Net Security
The Hacker News
Press · 05 Oct 2026, 07:00 · New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline - The Hacker News
Sophos
Press · 05 Oct 2026, 07:00 · Citrix NetScaler vulnerability (CVE-2026-88779) in active exploitation - Sophos
SOC Prime
Press · 05 Oct 2026, 07:00 · CVE-2026-88779: Citrix NetScaler Zero-Day Exploited Against SAML Deployments - SOC Prime
Cybersecurity Dive
Press · 05 Oct 2026, 07:00 · Citrix issues patch for third exploited flaw in NetScaler - Cybersecurity Dive
SecurityWeek
Press · 05 Oct 2026, 07:00 · Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier - SecurityWeek
Cyber Press
Press · 05 Oct 2026, 07:00 · Citrix Warns of Actively Exploited NetScaler Vulnerabilities Affecting ADC and Gateway - Cyber Press
Techzine Global
Press · 05 Oct 2026, 07:00 · Citrix warns of an actively exploited DoS vulnerability in NetScaler - Techzine Global
eSecurity Planet
Press · 05 Oct 2026, 07:00 · Citrix Patches NetScaler SAML Zero-Day CVE-2026-88779 Exploited in Attacks - eSecurity Planet
watchTowr
Press · 04 Oct 2026, 07:00 · Citrix NetScaler Denial Of Service (Memory Overflow) (CVE-2026-88779) - watchTowr
BleepingComputer
Press · 04 Oct 2026, 07:00 · Citrix patches NetScaler SAML zero-day exploited in attacks - BleepingComputer
Rapid7
Press · 28 Sep 2026, 07:00 · Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772 - Rapid7
CERT-FR
Technical advisory · 28 Sep 2026, 00:00 · Multiples vulnérabilités dans Citrix NetScaler ADC et Gateway (28 septembre 2026)
CERT-FR
Press · 28 Sep 2026, 00:00 · Multiples vulnérabilités dans Citrix NetScaler ADC et Gateway (28 septembre 2026)

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

024681002 Nov 2026 · HIGH ATTENTION + OBSERVED EXPLOITATIONHype 7.0Reality 8.402 Nov 2026 · HIGH ATTENTION + OBSERVED EXPLOITATIONHype 7.2Reality 8.405 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 4.2Reality 8.406 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 3.6Reality 8.4Nov 2Nov 2Nov 5Nov 6

━ Hype Score (Perceived)  ━ Reality threat priority. Definition changes are not new attacks.

Public exploit evidence

0

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 8.7; EPSS 11.4%
Attention, last 30 days
3 distinct story titles; 3 press documents; 2 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-06 00:12:49.640935+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
First press mention
28 Sep 2026, 00:00
Added to the CISA KEV catalog
04 Oct 2026, 00:00
Published
04 Oct 2026, 02:35
Latest press mention
19 Oct 2026, 15:11
Score calculated
06 Nov 2026, 00:12