Vulnerability · Published Sep 27, 2026 · Assigned by NetScaler

CVE-2026-88775Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service

High 8.8

In plain English

A high-severity buffer overflow in ADC from Citrix NetScaler. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)8.8High

Exploit odds (30 days)0.7%top 45.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service

Affected products (as reported)

Vendor	Product	Versions
Citrix NetScaler	ADC	0 – before 14.1-73.370 – before 13.1-64.230 – before 14.1-73.37 FIPS0 – before 13.1.37.279 FIPS and NDcPP
Citrix NetScaler	Gateway	0 – before 14.1-73.370 – before 13.1-64.23

Weakness: CWE-120 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

References

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778