The gateway only had to crash

The catalog line is an availability bug with a forensics order attached.

CISA today listed CVE-2026-88779, Citrix NetScaler ADC and Gateway, as an improper restriction of operations inside a memory buffer that could allow a denial of service. Ransomware use is marked unknown. Forensic triage is required. Civilian federal agencies have until 7 October, three days, under the same BOD 26-04 language that has been riding the other KEV entries this month: mitigate the way the vendor says, and look, do not only bump the build.

A crash is a fact about uptime. It is not, on the text CISA published, a fact about stolen cookies or a webshell. People will hear “NetScaler” and brief the last time a gateway bug was a door. That briefing is a memory of a different CVE. This entry says the box can be knocked over. The triage line is there because CISA does not want you to learn which one it was after the fact, and because a gateway that fell over is a bad time to skip the question of what else changed on it.

What the ticket will do with “denial of service”

It will schedule a reboot window and call the outage the whole story. The KEV action is the vendor mitigation plus a look at the appliance around the dates you cannot explain. Exposure still matters: an appliance that is not on the internet is a different urgency from one that terminates every remote session for the company. The due date does not contain that distinction. You do.

If the only symptom is a reload, write that down. If the logs around the reload show a configuration change, a new account, or a packet that was not a health check, the crash stopped being the whole sentence. Do not import a session-theft narrative from last year’s gateway bug to fill a gap Citrix has not filled.

The federal date is Wednesday. The bug, as written today, knocks the door over. The order is to check whether anyone walked through while it was down.