CVE-2026-88775: 
Citrix ADC VPX vulnerability analysis and mitigation

CVE-2026-88775 is a memory overflow vulnerability (CWE-120) affecting Citrix NetScaler ADC and Citrix NetScaler Gateway that can lead to unpredictable or erroneous behavior or Denial of Service. It was published on September 27, 2026, and is part of a broader set of eight vulnerabilities addressed in Citrix security bulletin CTX697096. Affected versions include NetScaler ADC before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; and NetScaler Gateway before 14.1-73.37 and before 13.1-64.23. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 8.8 (High) (GitHub Advisory, Citrix Advisory).

The vulnerability is classified as CWE-120 (Buffer Copy without Checking Size of Input — 'Classic Buffer Overflow'), where the product copies an input buffer to an output buffer without verifying that the input size does not exceed the output buffer's capacity. This flaw is exploitable remotely over the network without authentication, requiring no user interaction or special privileges, making it highly automatable. Successful exploitation can trigger memory corruption leading to unpredictable behavior, erroneous system states, or a complete denial of service condition. The vulnerability is part of a cluster of eight flaws disclosed simultaneously in NetScaler ADC and Gateway, with related CVEs (CVE-2026-88771 through CVE-2026-88778) covering a range of severity levels (GitHub Advisory, Citrix Advisory).

An unauthenticated remote attacker can trigger the memory overflow to cause unpredictable or erroneous behavior, potentially enabling arbitrary code execution, reading of sensitive data, modification of system configuration, or crashing the NetScaler service entirely. The high availability impact (CVSS VA:H) means that internet-facing ADC and Gateway appliances — which often serve as critical network chokepoints for enterprise VPN, load balancing, and application delivery — could be rendered inoperable. Given the role of these appliances in enterprise network access, successful exploitation could also facilitate lateral movement into internal networks or interception of sensitive authentication traffic (GitHub Advisory, Citrix Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit specifically for CVE-2026-88775, and no confirmed in-the-wild exploitation of this specific CVE has been reported (GitHub Advisory). However, sibling vulnerabilities in the same bulletin (notably CVE-2026-88771 and CVE-2026-88772) were confirmed as actively exploited zero-days at the time of disclosure, with CISA adding those to the Known Exploited Vulnerabilities (KEV) catalog (CISA Alert). The EPSS score for CVE-2026-88775 is approximately 0.384%, indicating a relatively lower near-term exploitation probability compared to its sibling CVEs, though the unauthenticated, network-accessible attack vector makes it a high-priority patching target. Qualys scanners have detection signatures available (IDs 388834 and 532715).

Citrix has released patched versions addressing CVE-2026-88775. Administrators should upgrade to the following fixed versions immediately:

• NetScaler ADC: 14.1-73.37 or later; 13.1-64.23 or later; 14.1-73.37 FIPS or later; 13.1.37.279 FIPS and NDcPP or later
• NetScaler Gateway: 14.1-73.37 or later; 13.1-64.23 or later

As interim measures, organizations should implement network segmentation to restrict access to NetScaler management interfaces, monitor for anomalous traffic targeting these appliances, and prioritize patching given the broader active exploitation of related vulnerabilities in the same bulletin. Qualys detection IDs 388834 and 532715 can be used to identify vulnerable instances (Citrix Advisory).

The broader disclosure of eight NetScaler vulnerabilities (CTX697096) generated significant industry attention, with CISA issuing an alert on September 27, 2026 regarding active exploitation of the most critical sibling CVEs (CISA Alert). Multiple national CERTs — including NCSC-UK, CERT-EU, Canada's Cyber Centre, and New Zealand's NCSC — issued advisories urging immediate patching (NCSC-UK, CERT-EU). Security researchers at watchTowr, Rapid7, Tenable, Orca Security, and Unit 42 published technical analyses of the vulnerability cluster, with watchTowr releasing detailed write-ups on the most critical RCE flaws (watchTowr). Community discussion on social media platforms highlighted concerns about the default-configuration exploitability of related vulnerabilities and the delay between discovery and patching.