Citrix NetScaler ADC and Gateway: Memory overflow causing denial of service
Deadline for US federal agencies: 7 Oct 2026
Summary
A memory overflow in NetScaler ADC and NetScaler Gateway allows a remote, unauthenticated attacker to cause a denial of service, with the appliance crashing and possibly rebooting. Citrix and CISA describe the scope as customer-managed devices configured as a SAML service provider or identity provider; Citrix-managed cloud services are not affected. The flaw is actively exploited and listed in the CISA KEV catalog. CISA also states that in unpatched systems it may be chained with CVE-2026-88771 to execute previously injected code.
Affected
- NetScaler ADC 14.1 before 14.1-73.41
- NetScaler ADC 13.1 before 13.1-64.28
- NetScaler ADC FIPS 14.1 before 14.1-73.41 FIPS
- NetScaler ADC FIPS 13.1 before 13.1-37.282
- NetScaler Gateway 14.1 before 14.1-73.41
- NetScaler Gateway 13.1 before 13.1-64.28
- Not affected: Citrix-managed cloud services
Fixed in
- NetScaler ADC and Gateway 14.1: 14.1-73.41 or later
- NetScaler ADC and Gateway 13.1: 13.1-64.28 or later
- NetScaler ADC FIPS 13.1: 13.1-37.282 or later
- Verify exact builds in Citrix advisory CTX697174
Workaround
- If patching is delayed, apply the Citrix virtual patch (Global Deny List signatures via NetScaler Console) or the responder policy from Citrix Support.
- Obtain the responder policy only from CTX697174, not from third-party copies.
- Check for SAML configuration (add authentication samlAction, add authentication samlIdPProfile) to determine exposure.
Exploitation
- Exploited in the wild; added to the CISA KEV catalog on 4 October 2026.
- Citrix has observed targeted attacks against unpatched deployments.
- Public proof of concept: Unknown.
- A third-party claim of remote code execution is not confirmed by Citrix or CISA.
Our recommendation
- Inventory all NetScaler ADC and Gateway appliances, including FIPS and hybrid use.
- Identify devices configured as SAML SP or IdP and patch them immediately to the fixed builds.
- If patching is delayed, apply the Citrix virtual patch or responder policy.
- Review logs and run Citrix IOC checks for compromise, as a fix does not remove an existing webshell.
- Also review CVE-2026-88771 (CTX697096) and CVE-2026-107406 (CTX697191).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Citrix Security Bulletin CTX697174 support.citrix.com
- Citrix community blog: Understanding and addressing CVE-2026-88779 community.citrix.com
- CISA Known Exploited Vulnerabilities Catalog www.cisa.gov
- CISA alert: KEV addition, 4 October 2026 www.cisa.gov
- Sophos: CVE-2026-88779 in active exploitation www.sophos.com
- Rapid7: Zero-day exploitation of NetScaler ADC and Gateway www.rapid7.com
- Helient: Citrix NetScaler SAML security update www.helient.com
- Tenable: FAQ on reported Citrix NetScaler zero-day vulnerabilities www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:36.
Original description (NVD)
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.
Required action (CISA)
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.