Citrix NetScaler ADC and Gateway memory overflow enables remote code execution (CVE-2026-88772)

What happened

Citrix NetScaler ADC and Citrix NetScaler Gateway contain a memory overflow vulnerability (CWE-119) that can lead to remote code execution or denial of service. The CVSS 4.0 vector scores it 9.5 critical: the flaw is reachable over the network, needs no privileges and no user interaction, but has high attack complexity. Successful exploitation can compromise confidentiality, integrity and availability of both the vulnerable device and subsequent systems.

CISA added CVE-2026-88772 to its Known Exploited Vulnerabilities catalogue on 27 September 2026, and CISA's SSVC assessment records exploitation as active. CISA has set 30 September 2026 as the due date for required action. The KEV entry records ransomware involvement as unknown.

Who is affected

Citrix NetScaler ADC and Citrix NetScaler Gateway are affected. For ADC, the vulnerable releases are before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP. For Gateway, the vulnerable releases are before 14.1-73.37 and before 13.1-64.23.

These are typically internet-facing ADC and remote access gateway roles. CISA's required action asks stakeholders to evaluate each asset's internet exposure, so internet-reachable appliances in particular should be patched first.

What to do now

1. Upgrade affected appliances to the matching fixed release: ADC 14.1-73.37, ADC 13.1-64.23, ADC 14.1-73.37 FIPS, ADC 13.1.37.279 FIPS and NDcPP, Gateway 14.1-73.37, or Gateway 13.1-64.23. No separate workaround is listed.
2. Follow CISA's KEV required action, including the applicable BOD 26-04 guidance; for cloud services, discontinue use if mitigations are unavailable.
3. Identify any NetScaler ADC or Gateway appliance reachable from the internet, confirm whether it is on a fixed build, and restrict access to management interfaces where possible.

How to detect it

CISA's KEV entry does not provide a specific indicator of compromise. The first detection step is to confirm which NetScaler ADC and Gateway appliances are reachable from the internet and to verify their builds against the fixed releases above. Pay particular attention to appliances that cannot be patched immediately, and monitor them through normal change and configuration auditing.

Beyond the patch

Patch first. This is an exploited-in-the-wild, network-reachable remote code execution flaw in an edge device, so the long-term question is whether you can find the next exposure before it appears in a KEV entry. Managed Detection & Response (MDR) gives you detection and response for post-exploitation activity, and Virtual CISO Services helps you systematically reduce internet-exposed management and appliance interfaces.