CVE-2026-88775 in ADC
Summary
by MITRE • 09/27/2026
Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/27/2026
The identified security flaw resides within the core architecture of Citrix NetScaler ADC and Citrix NetScaler Gateway, specifically impacting software versions prior to 14.1-73.37, 13.1-64.23, as well as their FIPS and NDcPP compliant variants which are affected if they precede version 14.1-73.37 for the former and 13.1.37.279 for the latter. This vulnerability is classified fundamentally as a memory overflow condition, a category of defect that typically arises when a program writes more data to a block of memory than it can hold. In the context of network appliances like NetScaler, such flaws often occur during the processing of specific input sequences or malformed packets destined for the management interface or application delivery services. The presence of this flaw indicates a failure in boundary checking mechanisms within the underlying codebase responsible for handling incoming requests, allowing an attacker to exceed allocated memory buffers and corrupt adjacent data structures.
From a technical perspective, memory overflow vulnerabilities are particularly dangerous because they can lead to arbitrary code execution if exploited with precision, although in this specific instance, the primary observed consequence is system instability rather than remote code execution. The immediate operational impact of triggering this vulnerability includes unpredictable behavior within the NetScaler appliance and potential Denial of Service conditions. When an attacker sends crafted requests that exploit the memory overflow, the affected process may crash or enter a corrupted state where it can no longer function correctly. This results in service interruption for users relying on the ADC or Gateway to access backend applications securely. The unpredictability mentioned suggests that the system might not always fail gracefully; instead, it could exhibit erratic behavior such as dropping legitimate connections, failing to authenticate users properly, or completely halting traffic processing until a manual restart is performed by an administrator.
This vulnerability aligns with Common Weakness Enumeration (CWE) identifiers associated with buffer overflows and improper memory management practices. Specifically, it relates to CWE-120 Buffer Copy without Checking Size of Input which leads to overflow and potentially CWE-787 Out-of-bounds Write if the corruption affects critical control structures. Furthermore, from a tactical standpoint within the MITRE ATT&CK framework, this vulnerability could be leveraged in conjunction with other techniques for initial access or impact, specifically under the category of Denial of Service (T1499). While an attacker might not gain persistent foothold through this specific flaw alone due to its destructive nature rather than stealthy execution capabilities, it serves as a potent tool for disrupting business continuity. The ability to cause a denial of service against critical infrastructure components like ADCs and Gateways poses a significant risk to organizational resilience, especially if these devices are positioned at the edge of the network perimeter handling high volumes of traffic.
Mitigation strategies must prioritize immediate patching to address this memory management defect. Administrators should upgrade Citrix NetScaler ADC and Gateway installations to version 14.1-73.37 or later for the non-FIPS/NDcPP variants, and ensure that FIPS and NDcPP compliant versions are updated to at least 14.1-73.37 and 13.1.37.279 respectively. Until patches can be applied in environments where immediate upgrades are not feasible due to compatibility or testing constraints, network-level mitigations should be implemented. This includes restricting access to the management interface of NetScaler devices to trusted IP addresses only via firewall rules or Access Control Lists. Additionally, deploying Web Application Firewalls with specific signatures capable of detecting malformed packets associated with buffer overflow attempts can provide a layer of defense in depth. Regular monitoring for unusual spikes in error logs or service interruptions on these appliances is also recommended to detect potential exploitation attempts early and maintain the integrity and availability of application delivery services.