CVE-2026-88777 - Vulnerability Details

- Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service

Description

Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.

This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to unpredictable or erroneous behavior or Denial of Service

Published: 2026-09-27

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a memory overflow in Citrix NetScaler ADC and Gateway that can cause unpredictable or erroneous behavior, including a denial of service. The flaw stems from improper validation of buffer boundaries, classified as CWE-119, and can allow an attacker to disrupt services without taking direct control of the device.

Affected Systems

Affected are Citrix NetScaler ADC versions earlier than 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, and 13.1.37.279 FIPS or NDcPP; and Citrix NetScaler Gateway versions earlier than 14.1-73.37 and 13.1-64.23.

Risk and Exploitability

The CVSS score is 8.8, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. Attackers could exploit the memory overflow by sending crafted traffic to the affected NetScaler devices over the network, leading to service interruption. The lack of a public exploit or listed KEV status does not reduce the risk, as the high CVSS and common network entry surface suggest a realistic threat.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Citrix NetScaler

ADC

unaffected

Version	Status	Constraints
`0`	affected	< 14.1-73.37
`0`	affected	< 13.1-64.23
`0`	affected	< 14.1-73.37 FIPS
`0`	affected	< 13.1.37.279 FIPS and NDcPP

Citrix NetScaler

Gateway

unaffected

Version	Status	Constraints
`0`	affected	< 14.1-73.37
`0`	affected	< 13.1-64.23

Configuration 1 [-]

OR	cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::-:::*
	cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::fips:::*
	cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::ndcpp:::*
	cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::-:::*
	cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::fips:::*
	cpe:2.3:a:citrix:netscaler_gateway::::::::
	cpe:2.3:a:citrix:netscaler_gateway::::::::

No data.

Vendor Product Confidence Versions

Citrix

Netscaler Adc

100%

Version	Status	Scheme	Platform
`[0,14.1-73.37)`	affected	generic	—
`[0,13.1-64.23)`	affected	generic	—
`[0,14.1-73.37 FIPS)`	affected	generic	—
`[0,13.1.37.279 FIPS and NDcPP)`	affected	generic	—

Citrix

Netscaler Gateway

100%

Version	Status	Scheme	Platform
`[0,14.1-73.37)`	affected	generic	—
`[0,13.1-64.23)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Citrix NetScaler ADC or Gateway to the latest firmware that includes the fix for CVE-2026-88777.
If an immediate upgrade is not possible, restrict inbound traffic to the NetScaler component to only trusted IP ranges by applying strict ACLs or firewall rules.
Disable unused services on the device and monitor logs for abnormal packet handling or repeated errors to detect potential exploitation attempts.

Generated by OpenCVE AI on September 27, 2026 at 17:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00384.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778

History

Tue, 29 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 28 Sep 2026 18:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Citrix netscaler Application Delivery Controller
CPEs		cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::-:::* cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::fips:::* cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::ndcpp:::* cpe:2.3:a:citrix:netscaler_gateway::::::::
Vendors & Products		Citrix netscaler Application Delivery Controller
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Mon, 28 Sep 2026 16:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Citrix Citrix netscaler Adc Citrix netscaler Gateway
Vendors & Products		Citrix Citrix netscaler Adc Citrix netscaler Gateway

Sun, 27 Sep 2026 17:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119

Sun, 27 Sep 2026 16:45:00 +0000

Type	Values Removed	Values Added
Description		Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to unpredictable or erroneous behavior or Denial of Service
Title		Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service
References		https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778
Metrics		cvssV4_0 `{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N'}`

Subscriptions

Citrix Netscaler Adc Netscaler Application Delivery Controller Netscaler Gateway

MITRE

Status: PUBLISHED

Assigner: NetScaler

Published: 2026-09-27T16:37:44.345Z

Updated: 2026-09-29T21:01:24.942Z

Reserved: 2026-09-10T07:14:57.370Z

Link: CVE-2026-88777

Vulnrichment

Updated: 2026-09-29T15:07:31.178Z

NVD

Status : Modified

Published: 2026-09-27T17:16:56.990

Modified: 2026-09-29T22:19:03.363

Link: CVE-2026-88777

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-28T16:24:13Z

Weaknesses

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object