CVE-2026-88772 is a high severity memory overflow flaw in Citrix NetScaler, scored 8.1. Upgrade to the first build past each boundary listed below. Check your installed version against the affected list below, then patch or restrict access until you can. CISA lists it as exploited, so move quickly.
What's affected
- NetScaler ADC before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 FIPS and NDcPP (the record writes 13.1.37.279).
- NetScaler Gateway before 14.1-73.37 and before 13.1-64.23.
Severity in the record: High (8.1), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Weakness: CWE-119.
Fix: Upgrade to the first build past each boundary listed below.
How to check if you're exposed
- Read the build from the appliance CLI:
show ns version. - Compare it to the fixed builds below for your release line.
- Check which appliances run as Gateway, ADC or both.
Run these on every affected device, including ones in remote sites, labs and spares that are powered on.
What to do now
- Confirm the version of every affected system using the checks above.
- Read the vendor advisory linked in Sources and note the fixed version for your release line.
- Schedule the update, starting with systems that face untrusted networks or hold the most sensitive data.
- In the meantime: review appliance logs for signs of compromise and follow the Citrix bulletin's guidance.
- Record the change, then recheck the version to confirm it took effect.
Why it matters
The record classes the flaw as CWE-119, improper restriction of operations within a memory buffer, and says it can lead to remote code execution or denial of service. Attack complexity is rated high. This CVE is in CISA's Known Exploited Vulnerabilities catalog, so exploitation has been reported. Treat patching as urgent.
CISA's Known Exploited Vulnerabilities catalog lists this CVE, which means exploitation has been observed. Federal agencies have remediation deadlines for KEV entries, and every other organization should treat the listing as a signal to patch first.
Network and management devices are patched less often than servers, because upgrades mean planned downtime. That gap is where a flaw like this stays open longest, so build the version check into your regular inventory.
The vector string in the record is a compact summary of how the flaw is reached and what it costs. AV is the attack vector (network, adjacent or local), PR is the privilege the attacker needs, and the C, I and A letters give the impact on confidentiality, integrity and availability. Read it against your own network layout rather than relying on the score alone.
After you patch
Patching is not the end of the job. Recheck the version on each system, because an upgrade that failed or rolled back looks the same as a success until someone looks. Keep the advisory link with your change record so the next reviewer can see why the update happened.
If you cannot patch soon, write down the reason, the compensating control you chose and a date to revisit. Exceptions without a date tend to become permanent.
Quick check
Is this exploited?
Yes. The record flags it as a CISA Known Exploited Vulnerability.
Sources
-
Citrix bulletin: CTX697096
-
Safeguard Gold: CVE-2026-88772
Last reviewed: 18 October 2026.
