What’s Vulnerable › Vulnerabilities

CVE-2026-88779: Memory overflow vulnerability leading to Denial of Service

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-10-04
• EPSS: 11.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-04 · updated 2026-10-05
• Weakness: CWE-119

Description

Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.

Summary

CVE-2026-88779 is a memory buffer bounds restriction flaw in Citrix NetScaler ADC and NetScaler Gateway that can allow improper memory operations, with a high CVSS score of 7.5. It affects ADC before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282, and Gateway before 14.1-73.41 and before 13.1-64.28. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, and EPSS estimates an 11.4% probability of exploitation in 30 days. Apply the fixed versions (ADC 13.1-37.282, 13.1-64.28, 14.1-73.41; Gateway 13.1-64.28, 14.1-73.41) or follow vendor mitigations and CISA BOD 26-04 guidance, discontinuing use if mitigations are unavailable.

CVE-2026-88779 هو خلل في تقييد العمليات ضمن حدود مخزن الذاكرة في Citrix NetScaler ADC وNetScaler Gateway، وقد يسمح بعمليات ذاكرة غير سليمة، بدرجة خطورة عالية CVSS 7.5. يؤثر في ADC قبل 14.1-73.41، وقبل 13.1-64.28، وقبل 14.1-73.41 FIPS، وقبل 13.1-37.282، وفي Gateway قبل 14.1-73.41 وقبل 13.1-64.28. الثغرة مدرجة في كتالوج CISA للثغرات المعروفة بالاستغلال مع استغلال نشط، ويقدّر EPSS احتمال الاستغلال خلال 30 يوماً بنسبة 11.4%. طبّق الإصدارات المصححة (ADC 13.1-37.282 و13.1-64.28 و14.1-73.41؛ Gateway 13.1-64.28 و14.1-73.41) أو اتبع تخفيفات المورّد وإرشادات CISA BOD 26-04، مع إيقاف استخدام المنتج إذا لم تتوفر التخفيفات.

Affected products

• Citrix NetScaler ADC: from 13.1 before 13.1-64.28; from 14.1 before 14.1-73.41 — fixed in 13.1-64.28, 14.1-73.41
• Citrix Netscaler Application Delivery Controller Fips: from 13.1 before 13.1-37.282; from 14.1-66.68 through 14.1-73.41 — fixed in 13.1-37.282
• Citrix Netscaler Application Delivery Controller Ndcpp: from 13.1 before 13.1-37.282 — fixed in 13.1-37.282
• Citrix NetScaler Gateway: from 13.1 before 13.1-64.28; from 14.1 before 14.1-73.41 — fixed in 13.1-64.28, 14.1-73.41
• NetScaler ADC: before 14.1-73.41; before 13.1-64.28; before 14.1-73.41 FIPS; before 13.1-37.282 — fixed in 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, 13.1-37.282
• NetScaler Gateway: before 14.1-73.41; before 13.1-64.28 — fixed in 14.1-73.41, 13.1-64.28

How to fix

Upgrade to a fixed version: Citrix NetScaler ADC 13.1-64.28, 14.1-73.41; Citrix Netscaler Application Delivery Controller Fips 13.1-37.282; Citrix Netscaler Application Delivery Controller Ndcpp 13.1-37.282; Citrix NetScaler Gateway 13.1-64.28, 14.1-73.41; NetScaler ADC 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, 13.1-37.282; NetScaler Gateway 14.1-73.41, 13.1-64.28. Check the vendor advisory for mitigations.

In the news

• This is Fine: What NetScaler Zero-Days Tell Us about the New Normal
• Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

References

• https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174
• https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88779

Get alerted when CVE-2026-88779 or the next vulnerability affects your stack