All vulnerabilities
CVE-2026-88776

ADC: Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service

Citrix NetScaler ADCNetwork & edge
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.38%Chance of exploitation activity in the next 30 days, higher than 31% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in14.1-73.37Also 13.1-64.23, 14.1-73.37 FIPS and 1 moreCVE List
Published27 Sep 2026Updated 29 Sep 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 27 Sep 2026, 16:36 UTCPublishedCVE List
  2. 28 Sep 2026, 10:55 UTCFirst reportwatchTowr Labs
  3. 23 Oct 2026, 23:39 UTCExploit code publicGitHub proof-of-concept repositories

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23  leading to unpredictable or erroneous behavior or Denial of Service

Text from CVE List

Affected versions 6

  • ADCaffected: all versions before 14.1-73.37CVE List
  • ADCaffected: all versions before 13.1-64.23CVE List
  • ADCaffected: all versions before 14.1-73.37 FIPSCVE List
  • ADCaffected: all versions before 13.1.37.279 FIPS and NDcPPCVE List
  • Gatewayaffected: all versions before 14.1-73.37CVE List
  • Gatewayaffected: all versions before 13.1-64.23CVE List

References 1