Citrix NetScaler ADC and Gateway Memory Buffer Vulnerability CVE-2026-88772

Catalog analysis: CISA added this entry on September 27, 2026. The entry reflects catalog information retrieved on September 28, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-88772 is a vulnerability involving the improper restriction of operations within the bounds of a memory buffer (CWE-119) affecting Citrix NetScaler ADC and NetScaler Gateway. This flaw could allow an attacker to achieve remote code execution (RCE) or cause a denial of service (DoS). Because these products are frequently used as gateways for secure remote access, this vulnerability represents a significant risk to the availability of clinical systems and the confidentiality of electronic protected health information (ePHI).

Exposure and applicability

This vulnerability is applicable to healthcare organizations, practices, and business associates utilizing Citrix NetScaler ADC or Gateway. These devices often sit at the perimeter of the network, providing the primary entry point for clinicians accessing Electronic Health Record (EHR) systems or other clinical applications remotely.

On September 27, 2026, CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. This indicates that the flaw is not merely theoretical but has been observed in active exploitation. For healthcare entities, an exploited gateway could lead to unauthorized network entry or a total loss of remote access capabilities, potentially disrupting patient care continuity.

Remediation priorities

Based on our analysis, we recommend the following prioritized actions for security leaders and network administrators:

1. Immediate Mitigation Deployment: Apply vendor-provided mitigations as specified in Citrix’s official guidance. This is the primary step to reduce the likelihood of initial compromise.
2. Forensic Triage: Because this vulnerability has been known to be exploited, applying a patch alone may not be sufficient if an attacker has already gained access. Organizations should conduct forensic triage following CISA’s BOD 26-04 requirements and utilize provided indicators of compromise (IOCs) within the NetScaler console to identify signs of prior exploitation.
3. Exposure Assessment: Evaluate all internet-facing NetScaler assets to prioritize patching for those with the highest exposure to public traffic.

How to validate remediation

To verify that the risk has been reduced, organizations should employ the following methods:

• Version Verification: Confirm that the installed firmware version matches the vendor’s recommended secure release. Note that a version check confirms the patch is present but does not prove the system was not previously compromised.
• IOC Review: Document the results of the forensic triage and IOC scans conducted in the NetScaler console to provide evidence of whether exploitation occurred prior to patching.
• Configuration Audit: Ensure that any additional vendor-recommended configuration changes are active and documented.

Limits and open questions

While applying mitigations reduces the likelihood of future exploitation, it does not automatically remove an attacker who may have already established persistence in the environment. The effectiveness of these measures depends on the thoroughness of the forensic triage performed.

It remains unknown whether this vulnerability has been utilized specifically in ransomware campaigns targeting healthcare providers. Additionally, while CISA provides a due date for federal agencies, private healthcare entities must determine their own patching urgency based on their specific risk profile and the criticality of the affected systems to patient care.

Source and editorial note

CVE-2026-88772: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability · Source date: September 27, 2026 · Retrieved September 28, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a healthcare security assessment