What’s Vulnerable › Vulnerabilities

CVE-2026-88777: Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-27 · updated 2026-09-29
• Weakness: CWE-119

Description

Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23  leading to unpredictable or erroneous behavior or Denial of Service

Summary

CVE-2026-88777 is a critical memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway that can cause unpredictable behavior or denial of service. It affects ADC versions before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway versions before 14.1-73.37 and before 13.1-64.23. There is no known exploitation in CISA KEV or SSVC, and EPSS is 0.7%. Apply the fixed versions: ADC 13.1-64.23, 13.1.37.279, or 14.1-73.37; Gateway 13.1-64.23 or 14.1-73.37.

CVE-2026-88777 هو ثغرة تجاوز سعة الذاكرة حرجة في Citrix NetScaler ADC وCitrix NetScaler Gateway، وقد تؤدي إلى سلوك غير متوقع أو خطأ أو حجب الخدمة. تؤثر على إصدارات ADC قبل 14.1-73.37، وقبل 13.1-64.23، وقبل 14.1-73.37 FIPS، وقبل 13.1.37.279 FIPS وNDcPP؛ وإصدارات Gateway قبل 14.1-73.37 وقبل 13.1-64.23. لا يوجد استغلال معروف في CISA KEV أو SSVC، واحتمال الاستغلال خلال 30 يومًا حسب EPSS هو 0.7%. قم بتثبيت الإصدارات المُصلحة: ADC 13.1-64.23 أو 13.1.37.279 أو 14.1-73.37؛ وGateway 13.1-64.23 أو 14.1-73.37.

Affected products

• Citrix NetScaler ADC: from 13.1 before 13.1-64.23; from 14.1 before 14.1-73.37 — fixed in 13.1-64.23, 14.1-73.37
• Citrix Netscaler Application Delivery Controller Fips: from 13.1 before 13.1.37.279; from 14.1-66.68 through 14.1-73.37 — fixed in 13.1.37.279
• Citrix Netscaler Application Delivery Controller Ndcpp: from 13.1 before 13.1.37.279 — fixed in 13.1.37.279
• Citrix NetScaler Gateway: from 13.1 before 13.1-64.23; from 14.1 before 14.1-73.37 — fixed in 13.1-64.23, 14.1-73.37
• NetScaler ADC: before 14.1-73.37; before 13.1-64.23; before 14.1-73.37 FIPS; before 13.1.37.279 FIPS and NDcPP — fixed in 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, 13.1.37.279 FIPS and NDcPP
• NetScaler Gateway: before 14.1-73.37; before 13.1-64.23 — fixed in 14.1-73.37, 13.1-64.23

How to fix

Upgrade to a fixed version: Citrix NetScaler ADC 13.1-64.23, 14.1-73.37; Citrix Netscaler Application Delivery Controller Fips 13.1.37.279; Citrix Netscaler Application Delivery Controller Ndcpp 13.1.37.279; Citrix NetScaler Gateway 13.1-64.23, 14.1-73.37; NetScaler ADC 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, 13.1.37.279 FIPS and NDcPP; NetScaler Gateway 14.1-73.37, 13.1-64.23. Check the vendor advisory for mitigations.

In the news

• 2026-014: Critical Vulnerabilities in Citrix NetScaler ADC and Gateway
• Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772)
• Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)

References

• https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778

Get alerted when CVE-2026-88777 or the next vulnerability affects your stack