CVE-2026-88776

Think of your NetScaler device as the front door and traffic controller for your company's remote access and web services. This bug lets a stranger send a malformed 'knock' that overloads the door's memory, jamming it shut or making it behave unpredictably — no key or password needed.

This matters to you if you run Citrix NetScaler ADC or Citrix NetScaler Gateway — these are the same product line, used for secure remote access and load balancing. It is a risk regardless of login status if the device is reachable from the internet or your network, since no authentication or user interaction is required to trigger it.

Treat this as urgent: it's an unauthenticated, network-reachable crash flaw with the highest severity rating, and other vulnerabilities released in this same Citrix update batch are already being actively exploited in the wild by sophisticated attackers. No public exploit code exists yet for this specific flaw, but given the pattern of active attacks on sibling bugs in the same release, waiting is not advisable.

1. Inventory all NetScaler ADC and Gateway instances and record their exact build numbers. 2. Confirm network exposure (internet-facing management or gateway interfaces are highest priority). 3. Upgrade to the fixed builds: ADC 14.1-73.37, ADC 13.1-64.23, ADC 14.1-73.37 FIPS, or ADC 13.1.37.279 FIPS/NDcPP; Gateway 14.1-73.37 or 13.1-64.23. 4. There is no documented workaround beyond upgrading — Citrix's advisory (CTX697096) should be followed for exact upgrade paths per branch, including any FIPS-specific steps. 5. This CVE is not yet in CISA KEV and has no assigned due date, but it ships alongside CVE-2026-88771 and CVE-2026-88772, which NCSC and Unit 42 confirm are under active zero-day exploitation — prioritize the whole patch batch together. 6. After patching, monitor for unexpected crashes, restarts, or memory errors in NetScaler logs as an indicator of attempted exploitation.

CVSS 3.1 score 9.8 (Critical), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — fully network-exploitable, no privileges or interaction, high impact to confidentiality, integrity, and availability. Weakness is CWE-119 (improper memory buffer restriction), triggering a memory overflow condition. No public exploit code and EPSS prediction is low (30th percentile), but this CVE is not KEV-listed and no dated exploitation claim exists specifically for it; however it was disclosed alongside CVE-2026-88771 (RCE via input validation failure) and CVE-2026-88772 (memory overflow), both confirmed under active zero-day exploitation by NCSC and Unit 42, raising the practical risk profile of the entire release.