Main Vulnerability Database Vulnerabilities #VU152295

Buffer overflow in Citrix Netscaler ADC and Citrix NetScaler Gateway - CVE-2026-88775

Published: September 28, 2026

Vulnerability identifier: #VU152295

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-88775

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service or trigger unpredictable or erroneous behavior.

The vulnerability exists due to a memory overflow in Gateway and AAA virtual servers when processing requests. A remote attacker can send crafted input to cause a denial of service or trigger unpredictable or erroneous behavior.

The affected configurations are Gateway virtual servers, including SSL VPN, ICA Proxy, CVPN, and RDP Proxy, and AAA virtual servers.

Affected software

Citrix Netscaler ADC
Citrix NetScaler Gateway

How to mitigate CVE-2026-88775

Install security update from vendor's website.

Citrix Netscaler ADC - addressed in versions 13.1-37.279, 13.1-64.23, 14.1-73.37
Citrix NetScaler Gateway - addressed in versions 13.1-64.23, 14.1-73.37

External References

Related Security Bulletins