CISA flags a Citrix NetScaler memory-buffer flaw as actively exploited

CISA has added CVE-2026-88779, a Citrix NetScaler memory-buffer vulnerability, to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. The agency's alert was last revised October 4, 2026. That makes the flaw a higher remediation priority, although the alert does not identify the attackers, victims or number of affected systems.

CISA describes the flaw as an improper restriction of operations within the bounds of a memory buffer. The agency says this type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risk to the federal enterprise.

The federal requirement has specific boundaries

Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV-listed CVEs when they affect publicly exposed assets and exploitation would grant total control of the asset. The directive also establishes basic expectations for checking whether attackers compromised a system before a patch was applied, while allowing lower-risk vulnerabilities to be deferred.

That directive applies only to those federal agencies. CISA separately encourages every organization to use risk-based vulnerability management and prioritize remediation of vulnerabilities in the KEV catalog. A catalog listing establishes evidence of exploitation; it does not, by itself, show that a specific deployment has been breached.