CVE-2026-88779: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.
Other sources
Vulnerability in NetScaler ADC and NetScaler Gateway.
This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Citrix NetScaler ADCto a version that resolves this vulnerability.Fixed in 14.1-73.41 - Upgrade
Upgrade
Citrix NetScaler ADCto a version that resolves this vulnerability.Fixed in 13.1-64.28 - Upgrade
Upgrade
Citrix NetScaler ADC FIPSto a version that resolves this vulnerability.Fixed in 14.1-73.41 - Upgrade
Upgrade
Citrix NetScaler ADCto a version that resolves this vulnerability.Fixed in 13.1-37.282 - Upgrade
Upgrade
Citrix NetScaler Gatewayto a version that resolves this vulnerability.Fixed in 14.1-73.41 - Upgrade
Upgrade
Citrix NetScaler Gatewayto a version that resolves this vulnerability.Fixed in 13.1-64.28 - Compensating control
Discontinue use of Citrix NetScaler ADC or Citrix NetScaler Gateway if mitigations are unavailable.
Event History
Frequently Asked Questions
Which NetScaler releases contain fixes for this issue?
For NetScaler ADC, fixed releases are 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, and 13.1-37.282, depending on the release train. For NetScaler Gateway, fixed releases are 14.1-73.41 and 13.1-64.28.
What is the documented impact of successful exploitation?
The issue is described as a memory overflow vulnerability that can lead to denial of service.