Vulnerability of 30 October 2026 · CVE-2026-88779

Citrix NetScaler ADC / Gateway Memory corruption (buffer overflow)

7.5 CVSS · highExploited

Memory corruption (buffer overflow) in Citrix NetScaler ADC / Gateway. Exploitable over the network, without logging in, without any user action. CVSS 7.5 (high). According to CISA it is already being exploited. Fixed in 13.1-37.282, 13.1-64.28 and 14.1-73.41.

Vendor security advisory

support.citrix.com · The vendor’s information prevails.

At a glance

CVE

CVE-2026-88779

Product

Citrix NetScaler ADC / Gateway

Vendor

Citrix

Affected versions

≥ 13.1, < 13.1-37.282
≥ 13.1, < 13.1-64.28
≥ 14.1, < 14.1-73.41
≥ 14.1-66.68, ≤ 14.1-73.41

per NVD

Fixed in

13.1-37.282, 13.1-64.28, 14.1-73.41

CVSS

7.5 (high)
CVSS 3.1, scored by NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Known exploited

Yes, per CISA (in the KEV catalog since 4 October 2026)

Weakness type

CWE-119 (Memory corruption (buffer overflow))

Published

4 October 2026

Last modified

5 October 2026

What to do

Update to a fixed version: 13.1-37.282, 13.1-64.28 and 14.1-73.41 or later, depending on the release line you run.
Read the vendor’s report: it gives the exact versions and, where available, workarounds in case you cannot update right away.
Since it is already exploited: after updating, check whether the system was compromised before.
Also check test, staging and forgotten installations of the same software.

Vendor security advisory ↗

Original description

From the CVE record. The summary above is built from the structured data.

Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.
Name at CISA: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Official references

support.citrix.com/support-home/kbsearch/articleVendor advisory
community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gatewayMitigationVendor advisory
cisa.gov/known-exploited-vulnerabilities-catalogUS government

Sources

Data from NIST’s NVD and CISA’s KEV catalog, retrieved on 1 November 2026. This product uses data from the NVD API but is not endorsed or certified by the NVD. No liability is accepted for this information.

NVD entry ↗CVE.org record ↗CISA KEV catalog ↗

Which software versions does your website give away? The free security check finds out.

Check for free