CVE-2026-88777 is a critical (CVSS 9.8) memory overflow in Citrix NetScaler ADC and NetScaler Gateway, with possible unpredictable behavior or denial of service. Citrix fixes it in 14.1-73.37 and 13.1-64.23 or later, and in the matching FIPS builds. Read bulletin CTX697096 for the full list.
What's affected
The record lists these affected versions:
- NetScaler ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 FIPS and NDcPP
- NetScaler Gateway: before 14.1-73.37 and before 13.1-64.23
The Citrix security bulletin CTX697096 covers this CVE together with several siblings, from CVE-2026-88771 to CVE-2026-88778, and could not be loaded when this guide was written. Read it for the full table, including any end of life builds.
How to check if you're exposed
On the appliance, sign in over SSH and read the build:
show version
Compare it with the fixed builds above for your release train. Then find out how the appliance is used: as a load balancer, as a gateway, or both. The bulletin lists which configurations are affected by which CVE, so match yours against it. Internet-facing appliances come first.
What to do now
- Read bulletin CTX697096 and list which of its CVEs apply to your configuration.
- Upgrade to 14.1-73.37 or 13.1-64.23 or later, or the fixed FIPS and NDcPP build for your line.
- Do the internet-facing appliances first, then internal ones.
- Save the configuration before upgrading, and for high availability pairs upgrade one node at a time.
- Review appliance logs and unexpected restarts from before the upgrade.
Why it matters
The record lists CWE-119 (improper restriction of operations within the bounds of a memory buffer), the same class as its sibling CVE-2026-88776. The two records share text, scores and affected versions, so one upgrade covers them, along with CVE-2026-88775.
Memory bugs in edge appliances matter because the device handles untrusted traffic all day. If you cannot upgrade at once, keep the management interface off the internet and watch for restarts. The record does not mark this CVE as known exploited, and it is not in the CISA KEV list.
Quick check
How do I confirm the fix landed?
Run show version on the appliance and compare the build with the fixed builds in the bulletin.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Listed in the record but not readable when this guide was written, so confirm details there:
Last reviewed: 19 October 2026.
