CVE Details

CVE-2026-88779 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Published: 2026-10-04 CVSS: 8.7 HIGH Product: Citrix NetScaler Due Date: 2026-10-07

Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.

GitHub PoC

Warning: GitHub PoC repositories are unverified. Some may be fake or contain malware. Use caution and review code before running anything.

No GitHub PoC data.

FIRST EPSS

EPSS estimates the probability of exploitation in the next 30 days. Higher values indicate higher likelihood of real-world exploitation.

No EPSS data.

Timeline

CVE Stalker KEV MITRE GitHub FIRST (EPSS)

MITRE

CVSS

  • Score: 8.7
  • Severity: HIGH
  • Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

  • Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

Show Raw Data
Key Remaining Key Value
dataType CVE_RECORD
dataVersion 5.2
cveMetadata > cveId CVE-2026-88779
cveMetadata > assignerOrgId 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5
cveMetadata > state PUBLISHED
cveMetadata > assignerShortName NetScaler
cveMetadata > dateReserved 2026-09-10T07:14:57.370Z
cveMetadata > datePublished 2026-10-04T02:35:35.525Z
cveMetadata > dateUpdated 2026-10-04T14:48:46.871Z
containers > cna > providerMetadata > orgId 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5
containers > cna > providerMetadata > shortName NetScaler
containers > cna > providerMetadata > dateUpdated 2026-10-04T02:35:35.525Z
containers > cna > title Memory overflow vulnerability leading to Denial of Service
containers > cna > datePublic 2026-10-04T02:19:00.000Z
containers > cna > affected > 0 > vendor NetScaler
containers > cna > affected > 0 > product ADC
containers > cna > affected > 0 > versions > 0 > status affected
containers > cna > affected > 0 > versions > 0 > version 0
containers > cna > affected > 0 > versions > 0 > lessThan 14.1-73.41
containers > cna > affected > 0 > versions > 0 > versionType Patch
containers > cna > affected > 0 > versions > 1 > status affected
containers > cna > affected > 0 > versions > 1 > version 0
containers > cna > affected > 0 > versions > 1 > lessThan 13.1-64.28
containers > cna > affected > 0 > versions > 1 > versionType Patch
containers > cna > affected > 0 > versions > 2 > status affected
containers > cna > affected > 0 > versions > 2 > version 0
containers > cna > affected > 0 > versions > 2 > lessThan 14.1-73.41 FIPS
containers > cna > affected > 0 > versions > 2 > versionType Patch
containers > cna > affected > 0 > versions > 3 > status affected
containers > cna > affected > 0 > versions > 3 > version 0
containers > cna > affected > 0 > versions > 3 > lessThan 13.1-37.282
containers > cna > affected > 0 > versions > 3 > versionType Patch
containers > cna > affected > 0 > defaultStatus unaffected
containers > cna > affected > 1 > vendor NetScaler
containers > cna > affected > 1 > product Gateway
containers > cna > affected > 1 > versions > 0 > status affected
containers > cna > affected > 1 > versions > 0 > version 0
containers > cna > affected > 1 > versions > 0 > lessThan 14.1-73.41
containers > cna > affected > 1 > versions > 0 > versionType Patch
containers > cna > affected > 1 > versions > 1 > status affected
containers > cna > affected > 1 > versions > 1 > version 0
containers > cna > affected > 1 > versions > 1 > lessThan 13.1-64.28
containers > cna > affected > 1 > versions > 1 > versionType Patch
containers > cna > affected > 1 > defaultStatus unaffected
containers > cna > descriptions > 0 > lang en
containers > cna > descriptions > 0 > value Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.
containers > cna > descriptions > 0 > supportingMedia > 0 > type text/html
containers > cna > descriptions > 0 > supportingMedia > 0 > base64 False
containers > cna > descriptions > 0 > supportingMedia > 0 > value Vulnerability in NetScaler ADC and NetScaler Gateway.<p>This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.</p>
containers > cna > references > 0 > url https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174
containers > cna > metrics > 0 > format CVSS
containers > cna > metrics > 0 > scenarios > 0 > lang en
containers > cna > metrics > 0 > scenarios > 0 > value GENERAL
containers > cna > metrics > 0 > cvssV4_0 > attackVector NETWORK
containers > cna > metrics > 0 > cvssV4_0 > attackComplexity LOW
containers > cna > metrics > 0 > cvssV4_0 > attackRequirements NONE
containers > cna > metrics > 0 > cvssV4_0 > privilegesRequired NONE
containers > cna > metrics > 0 > cvssV4_0 > userInteraction NONE
containers > cna > metrics > 0 > cvssV4_0 > vulnConfidentialityImpact NONE
containers > cna > metrics > 0 > cvssV4_0 > subConfidentialityImpact NONE
containers > cna > metrics > 0 > cvssV4_0 > vulnIntegrityImpact NONE
containers > cna > metrics > 0 > cvssV4_0 > subIntegrityImpact NONE
containers > cna > metrics > 0 > cvssV4_0 > vulnAvailabilityImpact HIGH
containers > cna > metrics > 0 > cvssV4_0 > subAvailabilityImpact NONE
containers > cna > metrics > 0 > cvssV4_0 > exploitMaturity NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > Safety NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > Automatable NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > Recovery NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > valueDensity NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > vulnerabilityResponseEffort NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > providerUrgency NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > version 4.0
containers > cna > metrics > 0 > cvssV4_0 > baseSeverity HIGH
containers > cna > metrics > 0 > cvssV4_0 > baseScore 8.7
containers > cna > metrics > 0 > cvssV4_0 > vectorString CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
containers > cna > source > discovery UNKNOWN
containers > cna > x_generator > engine Vulnogram 1.0.5
containers > adp > 0 > problemTypes > 0 > descriptions > 0 > type CWE
containers > adp > 0 > problemTypes > 0 > descriptions > 0 > cweId CWE-119
containers > adp > 0 > problemTypes > 0 > descriptions > 0 > lang en
containers > adp > 0 > problemTypes > 0 > descriptions > 0 > description CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
containers > adp > 0 > references > 0 > url https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/
containers > adp > 0 > references > 0 > tags > 0 vendor-advisory
containers > adp > 0 > metrics > 0 > other > type ssvc
containers > adp > 0 > metrics > 0 > other > content > timestamp 2026-10-04T14:37:26.606250Z
containers > adp > 0 > metrics > 0 > other > content > id CVE-2026-88779
containers > adp > 0 > metrics > 0 > other > content > options > 0 > Exploitation none
containers > adp > 0 > metrics > 0 > other > content > options > 1 > Automatable yes
containers > adp > 0 > metrics > 0 > other > content > options > 2 > Technical Impact partial
containers > adp > 0 > metrics > 0 > other > content > role CISA Coordinator
containers > adp > 0 > metrics > 0 > other > content > version 2.0.3
containers > adp > 0 > title CISA ADP Vulnrichment
containers > adp > 0 > providerMetadata > orgId 134c704f-9b21-4f2e-91b3-4a467353bcc0
containers > adp > 0 > providerMetadata > shortName CISA-ADP
containers > adp > 0 > providerMetadata > dateUpdated 2026-10-04T14:48:46.871Z