CVE-2026-88775

Executive Summary

CVE-2026-88775 is a memory overflow vulnerability affecting Citrix NetScaler ADC (Application Delivery Controller) and Citrix NetScaler Gateway. Multiple version branches are impacted across standard and FIPS/NDcPP builds, including ADC before 14.1-73.37 and before 13.1-64.23, Gateway before 14.1-73.37 and before 13.1-64.23, and the FIPS/NDcPP variants before 14.1-73.37 and before 13.1.37.279 FIPS. Successful exploitation leads to unpredictable or erroneous behavior or Denial of Service, which places these internet-facing appliances at operational risk.

Technical Analysis

The NVD description classifies CVE-2026-88775 as a memory overflow vulnerability. In the broader class of memory-safety defects, an overflow occurs when a program writes or reads beyond the bounds of an allocated memory region. Depending on the specific primitive, this can result in corruption of adjacent memory and lead to one of several outcomes: process crash, unpredictable control flow, or — in the worst case — memory corruption that a skilled attacker could pivot into remote code execution. The description explicitly enumerates the observed outcomes as "unpredictable or erroneous behavior or Denial of Service," which indicates the defect is at minimum a reliable availability-impacting flaw and may carry a higher-severity memory-corruption dimension.

Citrix NetScaler ADC and NetScaler Gateway are network appliances that terminate SSL/TLS and VPN traffic at the network edge. They are directly exposed to untrusted input from the public internet. The attack surface is the set of externally reachable services on these appliances (e.g., the management interface and the data-plane traffic handlers). A memory overflow in a component that parses network-supplied data is reachable by an unauthenticated remote attacker in the typical deployment model, which is consistent with the affected-product profile of an edge security appliance.

The affected version matrix is notable for two reasons. First, it spans both the standard firmware branches and the FIPS/NDcPP validated cryptographic modules. FIPS and NDcPP builds are subject to certification constraints that historically slow down the release and re-certification of fixes, so operators running the validated builds may face longer exposure windows. Second, the 13.1.37.279 FIPS threshold uses a different version numbering scheme than the mainline 13.1-64.23 branch, which can cause administrators to misjudge whether their deployment is in scope when auditing firmware inventories.

Specific implementation details — the affected function, the precise parser, the network protocol or input field that triggers the overflow, and the exact overflow mechanics (heap vs. stack, read vs. write primitive) — are not disclosed in the provided NVD description. The CNA title field is empty and no CWE is assigned in the supplied data. Analysts should therefore treat the vulnerability class (memory overflow in a network-facing edge appliance) as the analytically reliable fact and refrain from asserting more specific exploitation mechanics until the vendor advisory or a technical write-up is published.

Given the absence of a CVSS base score in the supplied data, the vector above is a class-appropriate analytical estimate (network vector, low complexity, no privileges, no user interaction, availability impact high) and should not be represented as the vendor or NVD-published score.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-88775, and no Nuclei template exists. The attack chain below is therefore inferred at the vulnerability-class level from the NVD description and must not be read as confirmed technical mechanics.

1. Reconnaissance and target identification. An attacker enumerates internet-exposed Citrix NetScaler ADC and Gateway appliances using Shodan or similar scanners, filtering on product fingerprints such as product:"Citrix NetScaler" or certificate subject attributes. Because the affected products are edge VPN/SSL appliances, exposed management interfaces and Gateway portals are the primary discovery targets. Fingerprinting firmware version is desirable but not strictly necessary for a memory-overflow class attack where the trigger is reachable across multiple version branches.

2. Triggering the flaw. The attacker sends crafted input to the vulnerable memory-handling component over the network. In the generic memory-overflow model, this means supplying a payload that exceeds the bounds the component expects for a given buffer or length field. The specific protocol, URI, header, or parameter that carries the oversized input is not disclosed in the available data, so no such value can be named. What can be stated is that triggering the defect requires no authentication and no user interaction in the typical edge-appliance threat model, and that the vulnerable code path processes network-originated data.

3. Payload and execution. At the vulnerability-class level, the attacker's goal is to violate the memory bounds assumptions of the parsing routine. Where the overflow is an out-of-bounds write, the attacker may attempt to shape the payload so that adjacent memory structures are corrupted in a controlled way; where it is an out-of-bounds read, the impact is more typically an information leak or a crash. The NVD description confirms only the availability and stability outcomes (unpredictable/erroneous behavior, Denial of Service), so any code-execution potential remains unconfirmed.

4. Post-exploitation impact. In the confirmed scenario, successful exploitation causes the affected appliance to behave unpredictably or to become unavailable. Because NetScaler ADC and Gateway sit on the critical path for application delivery and remote access, an availability failure at this layer cascades: VPN sessions drop, load-balanced applications become unreachable, and SSL offload ceases. If the defect proves to be a controllable write primitive, the post-exploitation consequence could elevate to code execution in the appliance context, but this is not established by the available data.

Impact Assessment

The primary confirmed impact is availability: unpredictable behavior or Denial of Service against Citrix NetScaler ADC and NetScaler Gateway. In a typical enterprise, these appliances are single points of failure for remote access (Gateway) and for inbound application traffic (ADC). A denial-of-service condition therefore affects not just the appliance but every user and application that depends on it.

Blast radius is broad. NetScaler is deployed at the network edge in regulated industries — finance, healthcare, government, and any organization using it for VPN or application delivery. The affected version matrix spans 13.1 and 14.1 branches, including FIPS and NDcPP validated builds. Organizations that must maintain FIPS/NDcPP validation face a secondary compliance impact: any interim mitigation that alters the validated cryptographic module state could affect their certification posture.

Because no NVD-published CVSS score, CWE, or EPSS value is available, quantitative prioritization should be handled carefully. The class-appropriate vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a remote, unauthenticated, high-availability-impact defect, which in most enterprise risk frameworks maps to High severity. If the overflow is later determined to permit memory corruption exploitable for code execution, the confidentiality and integrity subscores would rise and the severity would increase further. CISA KEV status is NO, and no exploit code is known, which modestly reduces urgency relative to a known-exploited vulnerability — but edge-appliance memory-safety bugs have historically been weaponized rapidly once technical details surface.

Detection Guidance

Sigma Rule

title: Potential Citrix NetScaler ADC/Gateway Memory Overflow Exploitation Attempt
id: 7f3c1e2a-9b4d-4c8e-a1f2-2026cve8877
status: experimental
description: Detects anomalous or oversized requests to Citrix NetScaler ADC/Gateway services that may indicate attempts to trigger CVE-2026-88775, a memory overflow leading to DoS.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-88775
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: citrix
detection:
  selection_method:
    cs-method:
      - GET
      - POST
  selection_host:
    cs-host|contains:
      - 'netscaler'
      - 'citrix'
  selection_oversize:
    sc-bytes|gte: 65535
  selection_status:
    sc-status:
      - 500
      - 502
      - 503
  condition: selection_host and selection_method and (selection_oversize or selection_status)
fields:
  - c-ip
  - cs-uri-stem
  - cs-host
  - sc-status
falsepositives:
  - Legitimate large file uploads
  - Normal administrative operations
level: high

YARA Rule

rule CVE_2026_88775_Citrix_NetScaler_MemoryOverflow
{
    meta:
        description = "Detects exploit attempts targeting a memory overflow in Citrix NetScaler ADC/Gateway (CVE-2026-88775)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-88775"
        severity = "high"

    strings:
        $a = "NetScaler" nocase
        $b = "Citrix Gateway" nocase
        $c = "ns_gui" nocase
        $d = "NSC_" nocase
        $e = { 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 }
        $f = { 25 6E 25 6E 25 6E 25 6E }

    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F) and
        any of ($a, $b, $c, $d) and
        any of ($e, $f)
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET [443,80] (msg:"CVE-2026-88775 Citrix NetScaler ADC/Gateway Memory Overflow Attempt"; flow:to_server,established; content:"|41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41|"; depth:2000; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-dos; reference:cve,2026-88775; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-88775; metadata:affected_product "Citrix NetScaler", created_at 2026_01_01, updated_at 2026_01_01; sid:202688775; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.protocol == "tcp" and destination.port in (80, 443) and
      url.path != null and
      string_length(url.path) > 512 ]
  [ network where network.protocol == "tcp" and destination.port in (80, 443) and
      http.response.status_code in (500, 502, 503) ]

Splunk SPL Query

index=proxy OR index=web sourcetype=c*:access_combined OR sourcetype=c*:stream:http
| eval is_netscaler=if(match(coalesce(cs_host, dest_host, url), "(?i)netscaler|citrix"), 1, 0)
| eval oversized=if(coalesce(sc_bytes, bytes, 0) > 65535 OR len(coalesce(cs_uri_stem, uri_path, "")) > 512, 1, 0)
| eval error_status=if(coalesce(sc_status, status, 0) >= 500, 1, 0)
| where is_netscaler=1 AND (oversized=1 OR error_status=1)
| stats count min(_time) as first_seen max(_time) as last_seen values(sc_status) as status_codes by src_ip, dest_host
| where count >= 5
| sort - count

Wazuh OSSEC Rule

<group name="citrix,netscaler,web,">
  <rule id="202688775" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">\.(cgi|pl|do|action)</field>
    <regex offset="after_parent">"(GET|POST)\s+\S{512,}</regex>
    <description>CVE-2026-88775: Oversized request to Citrix NetScaler ADC/Gateway - possible memory overflow exploitation attempt</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>attack_attempt,pci_dss_6.5.2,</group>
  </rule>

  <rule id="202688776" level="10" frequency="5" timeframe="60">
    <if_matched_sid>202688775</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-88775: Repeated oversized requests from same source - suspected DoS against NetScaler appliance</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4. No patch evidence exists from any tracked source, and no vendor fix or workaround is referenced in the provided data. The thresholds listed in the affected version ranges define the versions in scope, but absence of a corresponding fixed version in the supplied data means remediation status cannot be confirmed here.

1. Immediate mitigations. Restrict access to NetScaler management interfaces to trusted management networks only — these interfaces should never be reachable from the public internet. Where operationally feasible, apply rate limiting or upstream traffic inspection to reject anomalously oversized requests. Monitor availability of the appliance and configure alerting on process restarts, crashes, or sudden session drops, since these are the observable symptoms of the confirmed DoS outcome. Because the trigger payload is not publicly documented, no targeted signature-based blocking of a specific input can be recommended with confidence; generic oversized-request rejection and crash monitoring are the practical stopgaps.

2. Patch/upgrade steps. Track the Citrix security advisory for NetScaler ADC and NetScaler Gateway as the authoritative source for fixed builds. Determine your deployed branch and target the corresponding fixed version: ADC upgrade targets include versions at or above 14.1-73.37 and 13.1-64.23, with FIPS/NDcPP equivalents at or above 14.1-73.37 and 13.1.37.279; Gateway targets mirror 14.1-73.37 and 13.1-64.23. Verify the exact fixed build against the vendor advisory before upgrading, because the supplied data lists version thresholds affected — not confirmed patched releases — and no patch source validated a fix. For FIPS/NDcPP environments, coordinate with your compliance team before applying firmware changes to the validated module.

3. Long-term hardening. Maintain a firmware inventory that distinguishes standard, FIPS, and NDcPP builds, since the divergent version numbering (13.1-64.23 vs. 13.1.37.279) makes blind version matching unreliable. Segment edge appliances so that management planes are isolated from data planes and from general user networks. Enable verbose logging and forward NetScaler logs to the SIEM so the detection rules above have telemetry to operate on. Enforce a recurring patch cadence for internet-facing appliances and subscribe to Citrix security bulletins so that advisories for this CVE and future ones are actioned promptly.

References

• NVD — CVE-2026-88775: https://nvd.nist.gov/vuln/detail/CVE-2026-88775
• Citrix Security Advisories (NetScaler ADC and NetScaler Gateway): https://support.citrix.com/securitybulletins
• MITRE ATT&CK — T1499 Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• CWE-787 Out-of-bounds Write (class reference for memory overflow): https://cwe.mitre.org/data/definitions/787.html
• CISA Known Exploited Vulnerabilities Catalog (status check): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns, exploit-in-the-wild evidence, public PoC, or Nuclei template are associated with CVE-2026-88775 in the available data. CISA KEV status is NO.