Citrix NetScaler CVE-2026-88779 Exploited After Patch

Citrix NetScaler CVE-2026-88779 is on CISA KEV and actively exploited

CISA added CVE-2026-88779 to the Known Exploited Vulnerabilities catalog on October 4. This is an improper memory buffer restriction flaw in Citrix NetScaler, carrying a CVSS score of 7.5. It is not currently flagged as ransomware-linked, but it is confirmed under active exploitation, which moves it from patch eventually to patch now.

The detail that should worry NetScaler operators: SecurityWeek reports exploitation is hitting appliances that were patched only days earlier, and Help Net Security describes attackers crashing appliances outright. Cyber Security News frames the original issue as a SAML zero-day actively exploited in attacks. If you run NetScaler, confirm you are on a fixed build and that the fix actually took, because patched-then-breached is the pattern here.

Verify your own exposure before you assume you are covered. Senserva's non-Microsoft exploited-CVE tracker follows CISA KEV additions daily so you can check NetScaler against the current catalog.

The rest of the exploitation picture

Beyond NetScaler, several KEV-listed, ransomware-linked criticals are moving. JetBrains TeamCity CVE-2026-63077 is a deserialization flaw at CVSS 9.8 with an EPSS of roughly 0.90, and the older TeamCity path traversal CVE-2024-27199 sits at an EPSS of 0.9999. WebPros cPanel and WHM CVE-2026-41940, a missing authentication flaw at CVSS 9.8, carries an EPSS near 0.985. Palo Alto PAN-OS authentication bypass CVE-2026-0257, ConnectWise ScreenConnect CVE-2024-1708, and Meta React Server Components CVE-2025-55182 at CVSS 10 are all KEV-listed and ransomware-linked.

Fortinet FortiMail CVE-2026-104286 was added to KEV following active exploitation per Cyber Security News. Cisco Catalyst SD-WAN Manager CVE-2026-76504 rounds out the critical set. CISA also warned on Zammad vulnerabilities CVE-2026-102489 and CVE-2026-102490, with a reported zero-day chain that lets an AI agent hijack sessions, execute code, and escalate to root. SecurityWeek and BleepingComputer both report active scanning of Rejetto HFS servers for the critical RCE CVE-2026-61500.

Exchange out-of-band fix and a Windows update that breaks apps

Microsoft shipped an out-of-band Exchange Server update for CVE-2026-96940, a high-severity mailbox access bug, per Help Net Security. If you run on-premises Exchange, schedule this one; mailbox access flaws are exactly the kind attackers chain for data theft.

Separately, both Cyber Security News and BleepingComputer report that Windows 11 update KB5124010 is crashing some games, media players, and productivity apps. If you are mid-rollout through Intune, hold the ring or stage it carefully so you do not take a productivity hit while you are also racing on security patches.

The latest Patch Tuesday cumulative updates remain heavy: KB5046616 for Windows Server 2022 covers 37 CVEs, KB5046617 for Windows 11 24H2 ARM64 covers 33, and KB5046615 for Windows 10 1809 covers 31, all marked critical and KEV-relevant.

Do this first

Prioritize by exploitation status, not just CVSS. Senserva's free Microsoft Patch Tracker ranks your open Microsoft patches by CISA KEV, EPSS, and ransomware linkage so you can triage this list fast.

• Confirm every NetScaler appliance is on a fixed build for CVE-2026-88779, and verify the fix held given reports of patched devices still being hit.
• Apply the out-of-band Exchange Server update for CVE-2026-96940 on on-premises Exchange.
• Patch or isolate the ransomware-linked KEV movers you run: TeamCity CVE-2026-63077, cPanel CVE-2026-41940, PAN-OS CVE-2026-0257, ScreenConnect CVE-2024-1708.
• Patch FortiMail CVE-2026-104286 and Cisco Catalyst SD-WAN Manager CVE-2026-76504 if exposed.
• Stage or hold Windows 11 KB5124010 to avoid the reported app and game crashes while you deploy the critical cumulative updates.

Sources

• Cyber Security News: Citrix NetScaler SAML 0-Day Vulnerability Actively Exploited in Attacks (2026-10-05)
• Cyber Security News: CISA Adds Fortinet FortiMail 0-day Vulnerability to KEV Following Active Exploitation (2026-10-05)
• Cyber Security News: CISA Warns of Citrix NetScaler Vulnerability Actively Exploited in Attacks (2026-10-05)
• SecurityWeek: Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier (2026-10-05)
• Help Net Security: Out-of-band Exchange Server update fixes high-severity mailbox access bug (CVE-2026-96940) (2026-10-05)
• Help Net Security: CISA flags new exploited NetScaler flaw as attackers crash appliances (CVE-2026-88779) (2026-10-05)
• BleepingComputer: Microsoft: Windows KB5124010 update crashes some games and apps (2026-10-05)
• BleepingComputer: Rejetto HFS servers now actively scanned for critical RCE flaw (2026-10-05)
• CISA Cybersecurity Advisories: CISA Adds One Known Exploited Vulnerability to Catalog (2026-10-04)

Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-10-06.

Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.