CVE-2026-88776

Citrix Netscaler Application Delivery Controller: memory corruption can lead to denial of service

Risk score: 80/100
CVSS: 9.8 v3.1
Exploit chance (30 days): 0.4%
Published: 27 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is: Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to unpredictable or erroneous behavior …
Affected: Citrix Netscaler Application Delivery Controller before 14.1, 13.1, 13.1.37.279
Fix: Upgrade Citrix Netscaler Application Delivery Controller to 14.1, 13.1 or 13.1.37.279 (whichever matches your release line), or later.
Exploitation: No known exploitation

Why it is Red

CVSS 9.8 critical
Remotely exploitable without logging in
On your watchlist: citrix

References

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

Original description

Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to unpredictable or erroneous behavior or Denial of Service

Last activity 27 Sep 2026. Patch Forecast updates every hour.