CVE-2026-88777 Citrix NetScaler ADC & Gateway - Buffer Overflow

Citrix NetScaler ADC and Gateway before 14.1-73.37 and 13.1-64.23 contain a buffer overflow caused by improper memory handling, letting attackers cause denial of service or unpredictable behavior, exploit requires no special conditions.

CVSS base score 9.8 /10

Critical

CISA KEV: Not listed
Public exploit: None known
Authentication: Not required
EPSS: 0.38% chance of exploitation in 30 days

View the NVD record ↗

Details

Type: Buffer Overflow
Impact: Denial Of Service
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: 27 September 2026
Updated: 15 October 2026
Weakness: CWE-119

Vendor fix

Update to versions 14.1-73.37, 13.1-64.23 or later.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

References

Is CVE-2026-88777 reachable
in your estate?

A CVE describes the software, not your exposure. Panop discovers whether you run the affected product, then tests whether an attacker can actually reach it.

Book a demo Request a scan