CVE-2026-88776
Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service
- Published
- Sep 27, 2026
- Updated
- Sep 29, 2026
- Assigning CNA
- NetScaler
- Evidence observed
- Nov 4, 2026
Primary CVSS
nvd · CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XLow · next 30 days
- Percentile
- 54.5%
- Model date
- Nov 4, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to unpredictable or erroneous behavior or Denial of Service
Sources
- netscaler-cve-2026-88776-checkDetection
Offline NetScaler ADC / Gateway evidence checker for CVE-2026-88776. Reported firmware and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
- CVE-2026-88776Research
Technical write-up of CVE-2026-88776, a pre-auth integer underflow in NetScaler nsppe's Oracle TNS record parser causing an out-of-bounds write and packet engine crash.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.