Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
CVE-2026-88779: Citrix NetScaler can crash, causing service outage
CVE-2026-88779 · published 15 days ago · actively exploited
Summary
The Citrix NetScaler ADC and Gateway devices may stop working because of a flaw that lets attackers overload memory. This can lead to a denial of service, meaning users cannot access applications. Apply the latest vendor updates or patches to prevent the issue.
What to do
- Update netscaler adc to version 14.1-73.41 or later.
- Update netscaler gateway to version 14.1-73.41 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| citrix | netscaler | All versions |
| netscaler | adc | < 14.1-73.41 |
| netscaler | gateway | < 14.1-73.41 |
| citrix | netscaler_application_delivery_controller |
>= 13.1, < 13.1-37.282 >= 13.1, < 13.1-64.28 >= 14.1, < 14.1-73.41 >= 14.1-66.68, <= 14.1-73.41 cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:* |
| citrix | netscaler_gateway |
>= 13.1, < 13.1-64.28 >= 14.1, < 14.1-73.41 cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:* |
Original advisory text
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.
References
- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174 Vendor Advisory
- https://community.citrix.com/techzone-blogs/110_security-updates/understanding-a... Mitigation Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-... US Government Resource
Internet-facing
3 days
Internal
14 days
- Known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
<1%
chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published4 Oct 2026
Updated15 Oct 2026
First seen4 Oct 2026
Track software like this
Free during beta