What’s Vulnerable › Vulnerabilities
CVE-2026-88776: Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-27 · updated 2026-09-29
- Weakness: CWE-119
Description
Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to unpredictable or erroneous behavior or Denial of Service
Summary
CVE-2026-88776 is a critical memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway that can cause unpredictable behavior or denial of service. It affects ADC versions before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway versions before 14.1-73.37 and before 13.1-64.23. There is no known exploitation in CISA KEV or SSVC, and EPSS is 0.7%. Apply the fixed versions: ADC 13.1-64.23, 13.1.37.279, or 14.1-73.37; Gateway 13.1-64.23 or 14.1-73.37.
CVE-2026-88776 هو ثغرة فيضان ذاكرة حرجة في Citrix NetScaler ADC وCitrix NetScaler Gateway قد تؤدي إلى سلوك غير متوقع أو خطأ أو حجب الخدمة. تؤثر على إصدارات ADC قبل 14.1-73.37، وقبل 13.1-64.23، وقبل 14.1-73.37 FIPS، وقبل 13.1.37.279 FIPS وNDcPP؛ وإصدارات Gateway قبل 14.1-73.37 وقبل 13.1-64.23. لا يوجد استغلال معروف في CISA KEV أو SSVC، واحتمال الاستغلال خلال 30 يومًا حسب EPSS هو 0.7%. قم بتطبيق الإصدارات المُصلحة: ADC 13.1-64.23 أو 13.1.37.279 أو 14.1-73.37؛ وGateway 13.1-64.23 أو 14.1-73.37.
Affected products
- Citrix NetScaler ADC: from 13.1 before 13.1-64.23; from 14.1 before 14.1-73.37 — fixed in 13.1-64.23, 14.1-73.37
- Citrix Netscaler Application Delivery Controller Fips: from 13.1 before 13.1.37.279; from 14.1-66.68 through 14.1-73.37 — fixed in 13.1.37.279
- Citrix Netscaler Application Delivery Controller Ndcpp: from 13.1 before 13.1.37.279 — fixed in 13.1.37.279
- Citrix NetScaler Gateway: from 13.1 before 13.1-64.23; from 14.1 before 14.1-73.37 — fixed in 13.1-64.23, 14.1-73.37
- NetScaler ADC: before 14.1-73.37; before 13.1-64.23; before 14.1-73.37 FIPS; before 13.1.37.279 FIPS and NDcPP — fixed in 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, 13.1.37.279 FIPS and NDcPP
- NetScaler Gateway: before 14.1-73.37; before 13.1-64.23 — fixed in 14.1-73.37, 13.1-64.23
How to fix
Upgrade to a fixed version: Citrix NetScaler ADC 13.1-64.23, 14.1-73.37; Citrix Netscaler Application Delivery Controller Fips 13.1.37.279; Citrix Netscaler Application Delivery Controller Ndcpp 13.1.37.279; Citrix NetScaler Gateway 13.1-64.23, 14.1-73.37; NetScaler ADC 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, 13.1.37.279 FIPS and NDcPP; NetScaler Gateway 14.1-73.37, 13.1-64.23. Check the vendor advisory for mitigations.
In the news
- 2026-014: Critical Vulnerabilities in Citrix NetScaler ADC and Gateway
- Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772)
- Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)
References
Get alerted when CVE-2026-88776 or the next vulnerability affects your stack