CVE-2026-88776 is a critical (CVSS 9.8) memory overflow in Citrix NetScaler ADC and NetScaler Gateway, which Citrix says can cause unpredictable behavior or denial of service. Upgrade to 14.1-73.37 or 13.1-64.23 or later, or the fixed FIPS build, and read bulletin CTX697096.
What's affected
The record lists these affected versions:
- NetScaler ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 FIPS and NDcPP
- NetScaler Gateway: before 14.1-73.37 and before 13.1-64.23
The Citrix security bulletin CTX697096 covers this CVE together with several siblings, from CVE-2026-88771 to CVE-2026-88778, and could not be loaded when this guide was written. Read it for the full table, including any end of life builds.
How to check if you're exposed
On the appliance, sign in over SSH and read the build:
show version
Compare it with the fixed builds above for your release train. Then find out how the appliance is used: as a load balancer, as a gateway, or both. The bulletin lists which configurations are affected by which CVE, so match yours against it. Internet-facing appliances come first.
What to do now
- Read bulletin CTX697096 and list which of its CVEs apply to your configuration.
- Upgrade to 14.1-73.37 or 13.1-64.23 or later, or the fixed FIPS and NDcPP build for your line.
- Do the internet-facing appliances first, then internal ones.
- Save the configuration before upgrading, and for high availability pairs upgrade one node at a time.
- Review appliance logs and unexpected restarts from before the upgrade.
Why it matters
The record lists CWE-119 (improper restriction of operations within the bounds of a memory buffer). That class covers reads and writes outside the memory a program meant to use. Citrix says the outcome is unpredictable or erroneous behavior, or denial of service.
The same bulletin lists a sibling entry, CVE-2026-88777, with the same weakness class and the same affected versions, and a third overflow in CVE-2026-88775. Treat the three as one upgrade. The record does not mark this CVE as known exploited, and it is not in the CISA KEV list.
Quick check
Why are there so many NetScaler memory overflow CVEs?
Each CVE tracks a separate flaw. They are fixed in the same builds, so one upgrade covers them.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Listed in the record but not readable when this guide was written, so confirm details there:
Last reviewed: 19 October 2026.
