CVE-2026-88772

Memory overflow vulnerability leading to Remote Code Execution or Denial of Service

Exploited in the wild. In CISA KEV since 2026‑09‑27. Fixed versions are out.

CVSS 3.18.1High EPSS percentile70th1.3% chance in 30 days CISA KEVListedsince 2026-09-27, due 2026-09-30
No public exploit known Fix4 products4 fixed builds listed below

Published 2026-09-27Updated 2026-09-28Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Citrix NetScaler ADCAffected: < 14.1-73.37Upgrade to: 14.1-73.37Affected: < 13.1-64.23Upgrade to: 13.1-64.23Affected: < 14.1-73.37 FIPSUpgrade to: 14.1-73.37 FIPSAffected: < 13.1.37.279 FIPS and NDcPPUpgrade to: 13.1.37.279 FIPS and NDcPPStated by: CVE record
Citrix NetScaler GatewayAffected: < 14.1-73.37Upgrade to: 14.1-73.37Affected: < 13.1-64.23Upgrade to: 13.1-64.23Stated by: CVE record
Citrix Netscaler Application Delivery ControllerAffected: ≥ 13.1, < 13.1-64.23Upgrade to: 13.1-64.23Stated by: NVD
Citrix Netscaler GatewayAffected: ≥ 13.1, < 13.1-64.23Upgrade to: 13.1-64.23Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether you run Citrix NetScaler ADC and Gateway and identify its installed version and internet exposure.
Upgrade supported 14.1 systems to 14.1-73.37 or later, or supported 13.1 systems to 13.1-64.23 or later.
Have IT investigate the appliance for signs of compromise before and after updating, including WHIPSHOT web shells and SLAPSHOT tunneling software.

Vendor advisory Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

8 publishers

Vendor patch released
as reported · Oct 9, 2026·SecurityWeek summary
Exploitation reported in the wild
as reported · Oct 5, 2026·Help Net Security summary
Proof-of-concept published
as reported · Sep 30, 2026·The Hacker News summary
Advisory coverage
as reported · Sep 28, 2026·The Hacker News summary
Added to CISA KEV catalog
Sep 27, 2026·CISA KEV

Sourced from public security reporting — each date is when it was published, not when it happened. 7 further articles named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service

In plain language

Written by AI from the record

Citrix NetScaler ADC and Gateway versions before 14.1-73.37 or 13.1-64.23 have a serious flaw that attackers are actively using, so small businesses running them should act now.

Unauthenticated network-reachable CWE-119 memory overflow in Citrix NetScaler ADC and Gateway can enable remote code execution or denial of service.

If you're affected

Remote server takeover
Customer access disruption
Sensitive data exposure
Malware persistence
Business service outage

What is it

This is a flaw that can let an outsider take control of the device that directs users into business applications, or make it stop working. It is like a stranger finding a way past the building’s front desk and gaining access to the control room.

Who is affected

This matters to you if you use or run Citrix NetScaler ADC and Gateway to provide application access or remote access. It is especially important for systems serving customers, staff, or partners. It is a risk when the device is reachable from the internet; attackers do not need a login or someone to click anything.

How urgent is it

Attackers are already exploiting this vulnerability in real organizations, including to gain root access and install tools that preserve access and move through networks. Treat this as a red, emergency-level issue: CISA added it to its Known Exploited Vulnerabilities catalog and set a remediation due date of September 30, 2026.

What to do — in detail

Confirm the appliance role, software branch and exact build, then determine whether its management or application-facing services are internet reachable. Upgrade ADC and Gateway 14.1 deployments to 14.1-73.37 or later, and 13.1 deployments to 13.1-64.23 or later; for FIPS, use 14.1-73.37 FIPS or 13.1.37.279 FIPS and NDcPP. Review the vendor bulletin and release notes before upgrading, particularly where a branch change could affect configuration or supported features.

If an upgrade is delayed, follow Citrix’s vendor mitigation instructions and restrict internet exposure as far as operationally possible; discontinue use if effective mitigations are unavailable. CISA’s KEV due date was September 30, 2026. Perform compromise triage before relying on the update alone, looking for WHIPSHOT PHP web shells, SLAPSHOT tunneling tooling, unexpected root-level changes, and signs of persistence or lateral movement.

Technical context

CVE-2026-88772 is CVSS 8.1 High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), a CWE-119 memory overflow reachable over the network without authentication or user interaction. Confirmed exploitation has been ongoing since at least early September 2026; reporting describes unauthenticated RCE/root access followed by WHIPSHOT and SLAPSHOT deployment. It is in CISA KEV, which reflects confirmed exploitation and drove the September 30, 2026 remediation deadline. No public exploit code is on record. EPSS was 1.3% and flat, but that prediction is superseded by confirmed exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS70th

CISA KEV

Listed as exploited in the wild since 2026-09-27.

US federal agencies must remediate by 2026-09-30.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.3% chance of exploitation activity in the next 30 days, which ranks it in the 70th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

10 events over 1 day, from the signal feeds we watch.

2026-09-28Patch availablerecord updated, record updated, record updated
2026-09-27Added to CISA KEVpublished, weakness classified, att&ck mapped, record updated, record updated

Affected products

Citrix NetScaler
- ADC
- Gateway
citrixcommercial · USaka netscaler gateway firmware, application delivery controller firmware, xenserver
- netscaler application delivery controllerNetwork DeviceOn-premNetworking Infrastructure / load-balancer-proxy
- netscaler gatewaySecurity ProductOn-premNetworking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 8.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable