Patch Forecast
Red warning
Act within 24 hours.

CVE-2026-88777

Citrix Netscaler Application Delivery Controller: memory corruption can lead to denial of service

Risk score
80/100
CVSS
9.8 v3.1
Exploit chance (30 days)
0.4%
Published
27 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to unpredictable or erroneous behavior …
Affected
Citrix Netscaler Application Delivery Controller before 14.1, 13.1, 13.1.37.279
Fix
Upgrade Citrix Netscaler Application Delivery Controller to 14.1, 13.1 or 13.1.37.279 (whichever matches your release line), or later.
Exploitation
No known exploitation

Story map

Story map: Citrix Netscaler Application Delivery ControllerTHE FLAWSTHE FIXCVE-2026-88777Memory corruption can lead todenial of serviceCVSS 9.8 · EPSS 0%CVE-2026-88773Inconsistent interpretation ofHTTP requests ('HTTPRequest/Response smuggling')…CVSS 10.0 · EPSS 1%CVE-2026-88775Buffer overflow can lead todenial of serviceCVSS 9.8 · EPSS 0%CVE-2026-88776Memory corruption can lead todenial of serviceCVSS 9.8 · EPSS 0%Upgrade Citrix Netscaler…14.1 · 13.1 · 13.1.37.279or later on your release lineWho is exposedCitrix Netscaler ApplicationDelivery Controller before 14.1,13.1RED · ACT TODAYCitrix NetscalerApplication…Inconsistent interpretation ofHTTP requests ('HTTPRequest/Response smuggling')vulnerability in Citrix NetScalerADC and Citrix NetScalerGateway. This issue affectsADC: before 14.1-73.37, before…Where it standsNo known exploitationCONNECTS TOSame weaknessMemory corruption (CWE-119)271 other warnings in 30 days →Same productEarlier Citrix Netscaler Application DeliveryController warnings2 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Citrix Netscaler Application Delivery Controller: Red, act today. Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIPS and before 13.1-64…

The flaws

  • CVE-2026-88777: Memory corruption can lead to denial of service (CVSS 9.8 · EPSS 0%)
  • CVE-2026-88773: Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in… (CVSS 10.0 · EPSS 1%)
  • CVE-2026-88775: Buffer overflow can lead to denial of service (CVSS 9.8 · EPSS 0%)
  • CVE-2026-88776: Memory corruption can lead to denial of service (CVSS 9.8 · EPSS 0%)

The fix

Upgrade Citrix Netscaler Application Delivery Controller: 14.1 · 13.1 · 13.1.37.279 or later on your release line

Who is exposed: Citrix Netscaler Application Delivery Controller before 14.1, 13.1

Where it stands

  • No known exploitation

Connects to

Why it is Red

  • CVSS 9.8 critical
  • Remotely exploitable without logging in
  • On your watchlist: citrix

References

Original description

Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23  leading to unpredictable or erroneous behavior or Denial of Service

Last activity 27 Sep 2026. Patch Forecast updates every hour.