CISA KEV
CVE-2026-88772
Highest priority signal: CISA catalogues this CVE as known exploited.
CVSS
9.5
Severity
CRITICAL
CISA KEV
YES
Published
Sep 27, 2026
What the public data says
- Status NVD
- Analyzed
- Last modified
- Sep 28, 2026
- CVSS vector
- CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CWE
- CWE-119
- Added to KEV
- Sep 27, 2026
- CISA due date (US federal agencies)
- Sep 30, 2026
- CISA required action
- CISA: mitigate or discontinue the product
- CISA KEV
- Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
EPSS probability (FIRST)
- EPSS
- 1.3%
- Percentile
- 69.7%
- FIRST
- Snapshot Oct 11, 2026
How to interpret this record
Highest priority signal: CISA catalogues this CVE as known exploited.
Virtual Arena AI does not copy vendor or CNA vulnerability descriptions into this page. It exposes factual fields, its own prioritization context and links to authoritative sources.
Official sources
- NIST / NVD — CVE-2026-88772
- CVE.org — CVE-2026-88772
- FIRST — Exploit Prediction Scoring System
- CISA — Known Exploited Vulnerabilities Catalog
CISA KEV data is CC0. NIST/NVD is cited as the source of NVD factual fields. Third-party linked content keeps its own rights and terms.