Patch Forecast
Red warning
Act within 24 hours.

CVE-2026-88775

Citrix Netscaler Application Delivery Controller: buffer overflow can lead to denial of service

Risk score
80/100
CVSS
9.8 v3.1
Exploit chance (30 days)
0.4%
Published
27 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading Memory overflow vulnerability leading to unpredictabl…
Affected
Citrix Netscaler Application Delivery Controller before 14.1, 13.1, 13.1.37.279
Fix
Upgrade Citrix Netscaler Application Delivery Controller to 14.1, 13.1 or 13.1.37.279 (whichever matches your release line), or later.
Exploitation
No known exploitation

Story map

Story map: Citrix Netscaler Application Delivery ControllerTHE FLAWSTHE FIXCVE-2026-88775Buffer overflow can lead todenial of serviceCVSS 9.8 · EPSS 0%CVE-2026-88773Inconsistent interpretation ofHTTP requests ('HTTPRequest/Response smuggling')…CVSS 10.0 · EPSS 1%CVE-2026-88776Memory corruption can lead todenial of serviceCVSS 9.8 · EPSS 0%CVE-2026-88777Memory corruption can lead todenial of serviceCVSS 9.8 · EPSS 0%Upgrade Citrix Netscaler…14.1 · 13.1 · 13.1.37.279or later on your release lineWho is exposedCitrix Netscaler ApplicationDelivery Controller before 14.1,13.1RED · ACT TODAYCitrix NetscalerApplication…Inconsistent interpretation ofHTTP requests ('HTTPRequest/Response smuggling')vulnerability in Citrix NetScalerADC and Citrix NetScalerGateway. This issue affectsADC: before 14.1-73.37, before…Where it standsNo known exploitationCONNECTS TOSame weaknessBuffer overflow (CWE-120)33 other warnings in 30 days →Same productEarlier Citrix Netscaler Application DeliveryController warnings2 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Citrix Netscaler Application Delivery Controller: Red, act today. Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIPS and before 13.1-64…

The flaws

  • CVE-2026-88775: Buffer overflow can lead to denial of service (CVSS 9.8 · EPSS 0%)
  • CVE-2026-88773: Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in… (CVSS 10.0 · EPSS 1%)
  • CVE-2026-88776: Memory corruption can lead to denial of service (CVSS 9.8 · EPSS 0%)
  • CVE-2026-88777: Memory corruption can lead to denial of service (CVSS 9.8 · EPSS 0%)

The fix

Upgrade Citrix Netscaler Application Delivery Controller: 14.1 · 13.1 · 13.1.37.279 or later on your release line

Who is exposed: Citrix Netscaler Application Delivery Controller before 14.1, 13.1

Where it stands

  • No known exploitation

Connects to

Why it is Red

  • CVSS 9.8 critical
  • Remotely exploitable without logging in
  • On your watchlist: citrix

References

Original description

Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service

Last activity 27 Sep 2026. Patch Forecast updates every hour.