CVE-2026-88775

Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service

No known exploitation. EPSS puts it in the 30th percentile. Fixed versions are out.

CVSS 3.19.8Critical EPSS percentile30th0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix4 products4 fixed builds listed below

Published 2026-09-27Updated 2026-09-29Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Citrix NetScaler ADCAffected: < 14.1-73.37Upgrade to: 14.1-73.37Affected: < 13.1-64.23Upgrade to: 13.1-64.23Affected: < 14.1-73.37 FIPSUpgrade to: 14.1-73.37 FIPSAffected: < 13.1.37.279 FIPS and NDcPPUpgrade to: 13.1.37.279 FIPS and NDcPPStated by: CVE record
Citrix NetScaler GatewayAffected: < 14.1-73.37Upgrade to: 14.1-73.37Affected: < 13.1-64.23Upgrade to: 13.1-64.23Stated by: CVE record
Citrix Netscaler Application Delivery ControllerAffected: ≥ 13.1, < 13.1-64.23Upgrade to: 13.1-64.23Stated by: NVD
Citrix Netscaler GatewayAffected: ≥ 13.1, < 13.1-64.23Upgrade to: 13.1-64.23Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether you run Citrix NetScaler ADC or Gateway and record its version and whether it is a FIPS or NDcPP build.
Upgrade standard 14.1 systems to 14.1-73.37 or later, or standard 13.1 systems to 13.1-64.23 or later.
Upgrade FIPS systems to 14.1-73.37 FIPS or later, and 13.1 FIPS/NDcPP systems to 13.1.37.279 FIPS and NDcPP or later.
If an upgrade cannot happen immediately, restrict network access to the appliance to trusted administrators and required services only.

Vendor advisory Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service

In plain language

Written by AI from the record

Small businesses running Citrix NetScaler ADC or Gateway below 14.1-73.37 or 13.1-64.23 should act urgently because an internet-based attacker can knock the system offline without logging in.

Unauthenticated network-reachable memory overflow in Citrix NetScaler ADC and Gateway can cause unpredictable behavior or remote denial of service.

If you're affected

Gateway outage
Remote-access disruption
Application delivery outage
Business interruption

What is it

This is a flaw that lets someone send harmful traffic to the appliance and make it behave unpredictably or stop working. Think of it like overfilling a mailroom until it can no longer process deliveries: remote access and application connections that depend on it may be interrupted.

Who is affected

This matters to you if your business uses or runs Citrix NetScaler ADC or Gateway to deliver applications, provide remote access, or manage incoming connections. It is a risk when the appliance can be reached over the network, including its normal default configuration.

How urgent is it

Attackers can trigger an outage remotely without needing an account, so this is a red-priority issue. Reports of active attacks involve other Citrix NetScaler vulnerabilities, not CVE-2026-88775 specifically; nevertheless, this flaw is exposed by default and should be addressed on an urgent schedule.

What to do — in detail

Confirm the appliance model, firmware branch, and build from the NetScaler management interface or command line, then identify whether it is a standard, FIPS, or NDcPP deployment. Standard ADC and Gateway deployments should target 14.1-73.37 or later on the 14.1 branch, or 13.1-64.23 or later on the 13.1 branch; 14.1 FIPS should target 14.1-73.37 FIPS or later, while 13.1 FIPS and NDcPP should target 13.1.37.279 FIPS and NDcPP or later. Review vendor release notes and back up the appliance configuration before upgrading, because firmware upgrades can require maintenance downtime and compatibility checks. If patching is delayed, limit network exposure to trusted source networks and remove unnecessary public access paths. No CISA KEV remediation due date applies because this CVE is not listed in KEV. Monitor appliance availability, crash events, unexpected restarts, and unusual inbound connection activity until remediation is complete.

Technical context

CVE-2026-88775 is rated CVSS 9.8 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is classified as CWE-120 memory overflow. The documented attack vector is network-based, requires no authentication or user interaction, and is reachable in the default configuration; the stated capability is system crash or denial of service. CISA KEV does not list this CVE. News reports confirm exploitation of CVE-2026-88771 and CVE-2026-88772, but do not report exploitation of CVE-2026-88775 specifically. No public exploit code is on record. EPSS is 0.4% and flat, at the 30th percentile.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS30th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 30th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

9 events over 2 days, from the signal feeds we watch.

2026-09-29Patch availablerecord updated
2026-09-28Patch availablerecord updated, record updated
2026-09-27Publishedweakness classified, att&ck mapped, record updated

Affected products

citrixcommercial · USaka application delivery controller firmware, netscaler gateway firmware, xenserver
- netscaler application delivery controllerNetwork DeviceOn-premNetworking Infrastructure / load-balancer-proxy
- netscaler gatewaySecurity ProductOn-premNetworking Infrastructure
Citrix NetScaler
- ADC
- Gateway

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable