CVE-2026-88779NetScaler ADC
Vulnerability Summary
This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NAffected & Patched Versions
- NetScaler ADC < 14.1-73.41
- NetScaler ADC < 13.1-64.28
- NetScaler ADC < 14.1-73.41 FIPS
- NetScaler ADC < 13.1-37.282
- NetScaler Gateway < 14.1-73.41
- NetScaler Gateway < 13.1-64.28
- NetScaler ADC 14.1-73.41
- NetScaler ADC 13.1-64.28
- NetScaler ADC 14.1-73.41 FIPS
- NetScaler ADC 13.1-37.282
- NetScaler Gateway 14.1-73.41
- NetScaler Gateway 13.1-64.28
What to do
Patch now. CISA lists this flaw as exploited in the wild and set a federal remediation deadline of Oct 7, 2026.
- Check whether you run NetScaler ADC and which version.
- Update to a patched version listed above, then confirm the new version.
- Review logs and exposed services for signs of earlier compromise.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA KEV Status
Remediation due: Oct 7, 2026 (deadline passed)
Timeline
- Oct 4, 2026Added to CISA KEV catalog
- Oct 4, 2026Published
- Oct 5, 2026Record last modified
- Oct 7, 2026KEV remediation due date
Score, severity and exploitation changes are tracked from the day Watchtower started logging them.
Related Coverage
More NetScaler ADC CVEs
External References
Data last checked: Nov 13, 2026 09:12 (site time)