Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-88772: Citrix NetScaler ADC and Gateway allow remote takeover

CVE-2026-88772 · published 22 days ago · actively exploited

Summary

The NetScaler ADC and NetScaler Gateway products have a flaw that lets an attacker run their own code or crash the service from outside the network. This could let a hacker control the device or cause it to stop working, affecting any services that rely on it. Install the latest security updates from Citrix as soon as possible and verify the patch is applied.

What to do

Update citrix netscaler adc to version 14.1-73.37 or later.
Update citrix netscaler gateway to version 14.1-73.37 or later.

Affected software

Vendor	Product	Affected versions
citrix	netscaler	All versions
citrix netscaler	adc	< 14.1-73.37
citrix netscaler	gateway	< 14.1-73.37
citrix	netscaler_application_delivery_controller	>= 13.1, < 13.1-64.23 >= 13.1, < 13.1.37.279 >= 14.1, < 14.1-73.37 >= 14.1-66.68, <= 14.1-73.37 `cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::-:::*`
citrix	netscaler_gateway	>= 13.1, < 13.1-64.23 >= 14.1, < 14.1-73.37 `cpe:2.3:a:citrix:netscaler_gateway::::::::`

Original advisory text

Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service

References

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096... Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-... US Government Resource

Fix within

Internet-facing 3 days

and check for signs of compromise

Internal 14 days

Known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.5 Critical

Exploitation

Known exploited

Listed in the CISA KEV catalogue - exploitation confirmed in the wild.

1% chance of attack within 30 days

Type

CWE-119Buffer Overflow

Timeline

Published27 Sep 2026

Updated15 Oct 2026

First seen27 Sep 2026

Sources

CVE-2026-88772 · NVD

CVE-2026-88772 · MITRE

CVE-2026-88772 · CISA KEV

Track software like this

Free during beta