Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-88775: Citrix NetScaler ADC and Gateway may crash or hang

CVE-2026-88775 · published 22 days ago

Summary

Older versions of Citrix NetScaler ADC and NetScaler Gateway can run into a memory overflow that may cause the device to behave unexpectedly, crash, or stop responding. This can interrupt network traffic and impact user access. Upgrade to the latest released software version or apply the vendor's recommended patches to resolve the issue.

What to do

Update citrix netscaler adc to version 14.1-73.37 or later.
Update citrix netscaler gateway to version 14.1-73.37 or later.

Affected software

Vendor	Product	Affected versions
citrix netscaler	adc	< 14.1-73.37
citrix netscaler	gateway	< 14.1-73.37
citrix	netscaler_application_delivery_controller	>= 13.1, < 13.1-64.23 >= 13.1, < 13.1.37.279 >= 14.1, < 14.1-73.37 >= 14.1-66.68, <= 14.1-73.37 `cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::-:::*`
citrix	netscaler_gateway	>= 13.1, < 13.1-64.23 >= 14.1, < 14.1-73.37 `cpe:2.3:a:citrix:netscaler_gateway::::::::`

Original advisory text

Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service

Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.

This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service

References

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096... Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-120Classic Buffer Overflow

Timeline

Published27 Sep 2026

Updated19 Oct 2026

First seen27 Sep 2026

Sources

CVE-2026-88775 · NVD

CVE-2026-88775 · MITRE

Track software like this

Free during beta