CVE-2026-88772
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service
CISA due Sep 30, 2026
- Citrix NetScaler
- Critical
- CVSS 9.5
- EPSS 5.31%
- Fixed version listed
What to do
Fixed version listed
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.
- CISA deadline for US federal agencies
- Sep 30, 2026
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| Citrix NetScaler ADC | before 14.1-73.37; before 13.1-64.23; before 14.1-73.37 FIPS; before 13.1.37.279 FIPS and NDcPP | None listed |
| Citrix NetScaler Gateway | before 14.1-73.37; before 13.1-64.23 | 14.1-73.37 |
Scores and signals
- Exploitation
- Exploited in the wild
- Severity
- Critical, CVSS 9.5 (v4.0, scored by NetScaler)
- EPSS
- 5.31% chance of exploitation in the next 30 days (EPSS from FIRST, as of Oct 23, 2026)
- CISA's SSVC decision points
- Exploitation: active. Automatable: no. Technical impact: total. As of Sep 27, 2026.
- Weakness
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
- Vendor
- Citrix, NetScaler
Timeline
- Added to CISA's Known Exploited Vulnerabilities catalog: exploited in the wild. US federal agencies must remediate by 2026-09-30.