CVE-2026-88775 is a critical (CVSS 9.8) buffer overflow in Citrix NetScaler ADC and NetScaler Gateway. Citrix says it can lead to unpredictable behavior or denial of service. Upgrade to 14.1-73.37 or 13.1-64.23 or later, or the fixed FIPS build, and read bulletin CTX697096.
What's affected
The record lists these affected versions:
- NetScaler ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 FIPS and NDcPP
- NetScaler Gateway: before 14.1-73.37 and before 13.1-64.23
The Citrix security bulletin CTX697096 covers this CVE together with several siblings, from CVE-2026-88771 to CVE-2026-88778, and could not be loaded when this guide was written. Read it for the full table, including any end of life builds.
How to check if you're exposed
On the appliance, sign in over SSH and read the build:
show version
Compare it with the fixed builds above for your release train. Then find out how the appliance is used: as a load balancer, as a gateway, or both. The bulletin lists which configurations are affected by which CVE, so match yours against it. Internet-facing appliances come first.
What to do now
- Read bulletin CTX697096 and list which of its CVEs apply to your configuration.
- Upgrade to 14.1-73.37 or 13.1-64.23 or later, or the fixed FIPS and NDcPP build for your line.
- Do the internet-facing appliances first, then internal ones.
- Save the configuration before upgrading, and for high availability pairs upgrade one node at a time.
- Review appliance logs and unexpected restarts from before the upgrade.
Why it matters
The record lists CWE-120 (classic buffer overflow). A buffer overflow happens when code copies more data into a fixed space than it can hold. The record says the effect is unpredictable behavior or denial of service, and the vector shows network access with no privileges or user interaction.
This is one of three memory overflow entries in the same bulletin, CVE-2026-88775, CVE-2026-88776 and CVE-2026-88777, so patching once handles all three. The record does not mark this CVE as known exploited, and it is not in the CISA KEV list.
Quick check
Do I need to patch for each of the three overflow CVEs?
No. They share affected versions, so the same upgrade covers all of them. Confirm in bulletin CTX697096.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Listed in the record but not readable when this guide was written, so confirm details there:
Last reviewed: 19 October 2026.
