CISA KEV (4 Oct) for Citrix NetScaler ADC/Gateway memory-buffer DoS (CVE-2026-88779) when appliance is SAML SP or IdP — customer-managed builds only; patch to Citrix fixed floors; BOD 26-04 forensic triage flagged; ransomware use Unknown — not a rehash of Oct 1 Cisco Catalyst KEV.
CISA’s 4 Oct 2026 alert added CVE-2026-88779 (Citrix NetScaler ADC/Gateway memory-buffer vulnerability enabling denial of service when the appliance is configured as a SAML SP or IdP) to the KEV catalog. Citrix CTX697174 lists fixed floors (including 14.1-73.41+ and 13.1-64.28+ on listed trains); customer-managed appliances only. KEV metadata: due 2026-10-07 for FCEB; forensic triage required per BOD 26-04 Yes; ransomware campaign use Unknown. Soft hold: no invented Nigerian campaigns; do not conflate with the Sep 27 NetScaler RCE KEV cluster (CVE-2026-88771/88772) or Oct 1’s Cisco Catalyst KEV. Buyer checklist: inventory SAML SP/IdP NetScalers, upgrade, preserve evidence before remediation.
Source: CISA — adds one Known Exploited Vulnerability to catalog (2026-10-04) · Vendor: Citrix CTX697174 · Soft hold: FCEB due 2026-10-07 as catalog metadata; no invented NG campaigns; do not conflate with Sep 27 RCE cluster (88771/88772) or Oct 1 Cisco KEV