CVE-2026-88777

CVE-2026-88777 is a memory overflow in Citrix NetScaler ADC and Citrix NetScaler Gateway that can cause unpredictable or erroneous behavior or a denial of service. It is reachable over the network with no privileges and no user interaction (CVSS 4.0 8.8); the scored impact is low confidentiality and integrity loss and high availability loss, and the advisory text does not describe remote code execution. Affected builds are ADC before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP, and Gateway before 14.1-73.37 and before 13.1-64.23. Organizations running those ADC or Gateway releases, especially internet-facing appliances, are exposed. No public proof-of-concept is known and the CVE is not in CISA KEV; a related headline about exploited NetScaler zero-day RCE does not name this CVE and is not treated as confirmation for it.

What to do: Upgrade Citrix NetScaler ADC and NetScaler Gateway to 14.1-73.37 or 13.1-64.23 (or later in those trains), ADC FIPS to 14.1-73.37 or later, and ADC FIPS/NDcPP to 13.1.37.279 or later. Until patched, limit internet exposure of ADC and Gateway services and watch for crashes, session errors, or other availability failures.