Description
Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23  leading to unpredictable or erroneous behavior or Denial of Service
Published: 2026-09-27
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Now
AI Analysis

Impact

A memory overflow vulnerability exists in Citrix NetScaler ADC and Gateway that can cause unpredictable or erroneous behavior, which in some circumstances may result in a denial of service. The description does not specify whether code execution or privilege escalation is possible.

Affected Systems

Citrix NetScaler ADC versions before 14.1‑73.37, 13.1‑64.23, 14.1‑73.37 FIPS, and 13.1‑37.279 FIPS and NDcPP; and Citrix NetScaler Gateway versions before 14.1‑73.37 and before 13.1‑64.23. These versions are still used in many environments.

Risk and Exploitability

The CVSS score of 8.8 classifies the flaw as high severity. EPSS score of 0.00341 indicates a very low expected probability of exploitation. The vulnerability is not listed in the CISA KEV catalog; this lack of listing does not imply low risk. The description does not disclose the attack vector or exploitation prerequisites, leaving the exact likelihood of exploitation uncertain.

Generated by OpenCVE AI on September 28, 2026 at 22:08 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Citrix NetScaler ADC and Gateway firmware updates that address the memory overflow issue
  • Limit external network access to NetScaler appliances through firewall or ACLs to reduce exposure
  • Enable comprehensive logging on NetScaler and monitor for abnormal traffic patterns that may indicate an attempt to trigger the overflow

Generated by OpenCVE AI on September 28, 2026 at 22:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 29 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 28 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-120

Mon, 28 Sep 2026 18:15:00 +0000

Type Values Removed Values Added
First Time appeared Citrix netscaler Application Delivery Controller
Weaknesses CWE-119
CPEs cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*
cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*
cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*
cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*
Vendors & Products Citrix netscaler Application Delivery Controller
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Mon, 28 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Citrix
Citrix netscaler Adc
Citrix netscaler Gateway
Vendors & Products Citrix
Citrix netscaler Adc
Citrix netscaler Gateway

Sun, 27 Sep 2026 18:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-120

Sun, 27 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
Description Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23  leading to unpredictable or erroneous behavior or Denial of Service
Title Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service
References
Metrics cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Citrix Netscaler Adc Netscaler Application Delivery Controller Netscaler Gateway
cve-icon MITRE

Status: PUBLISHED

Assigner: NetScaler

Published:

Updated: 2026-09-29T16:06:45.542Z

Reserved: 2026-09-10T07:14:57.369Z

Link: CVE-2026-88776

cve-icon Vulnrichment

Updated: 2026-09-29T15:12:52.439Z

cve-icon NVD

Status : Modified

Published: 2026-09-27T17:16:56.870

Modified: 2026-09-29T17:17:11.850

Link: CVE-2026-88776

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-28T22:15:09Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer