Zero Radar
← feed
CriticalVulnerabilityCVE-2026-88779updated 25 Oct 2026, 17:35 UTC

Citrix NetScaler ADC and Gateway can crash from memory handling flaw

A flaw in Citrix NetScaler appliances can let an outsider knock the device offline by sending it crafted traffic. These devices sit at the edge of many company networks, so an outage can cut off remote access for everyone.

Exploited (CISA KEV)Fix availableOfficial, 2 sources
SeverityCriticalCVSS 8.7 of 10
Being exploited?YesConfirmed by CISA KEV · 4 Oct 2026,
Fix available?YesUpgrade to NetScaler ADC 14.1-73.41 or later, 13.1-64.28 or later, 14.1-73.41 FIPS, or 13.1-37.282 or later; NetScaler Gateway 14.1-73.41 or later, or 13.1-64.28 or later. · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1AttackerSends crafted network traffic
  2. 2InternetTraffic reaches exposed appliance
  3. 3NetScaler applianceMemory buffer handled out of bounds
  4. 4Service crashAppliance stops responding
  5. ResultRemote access and gateway services go down

What happened

Improper restriction of operations within a memory buffer in NetScaler ADC and NetScaler Gateway allows a denial of service (device crash or hang).

Why it is dangerous: An attacker can disrupt availability of the appliance, taking down remote access, load balancing and VPN-style gateway services for users and applications behind it.

Are you affected?

You are affected if you run NetScaler ADC before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, or before 13.1-37.282, or NetScaler Gateway before 14.1-73.41 or before 13.1-64.28.

NetScaler ADC: before 14.1-73.41; before 13.1-64.28; before 14.1-73.41 FIPS; before 13.1-37.282. NetScaler Gateway: before 14.1-73.41; before 13.1-64.28.

What to do

  1. Upgrade NetScaler ADC and Gateway to 14.1-73.41 or later, or 13.1-64.28 or later (13.1-37.282 or later for ADC on that branch).
  2. Check whether each appliance is reachable from the internet and prioritise internet-facing devices.
  3. Follow CISA BOD 26-04 guidance and the vendor mitigation instructions, and apply CISA's forensics triage requirements if compromise is suspected.
  4. If an upgrade is not possible, discontinue use of the product or apply vendor mitigations as directed by CISA.

Timeline

  1. 4 Oct 2026, 00:00 UTC
    Publicly disclosed
  2. 4 Oct 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 25 Oct 2026, 17:35 UTC
    GitHub Advisory reported on it · GitHub Advisory
  4. 25 Oct 2026, 17:35 UTC
    Fix: Upgrade to NetScaler ADC 14.1-73.41 or later, 13.1-64.28 or later, 14.1-73.41 FIPS, or 13.1-37.282 or later; NetScaler Gateway 14.1-73.41 or later, or 13.1-64.28 or later.

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-88779 · GHSA-56r3-m27m-8p62
CVSS
8.7 / 10
EPSS
11% chance of exploitation within 30 days
Disclosed
4 Oct 2026, 00:00 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:35 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Citrix NetScaler ADC and Gateway can crash from memory handling flaw · Zero Radar