CVE-2026-88772

HighCVSS 8.1/10Known exploited (CISA KEV)Last modified Sep 28, 2026

Description

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.

This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

VendorProductVersions
Citrix NetScalerADC< 14.1-73.37; < 13.1-64.23; < 14.1-73.37 FIPS; < 13.1.37.279 FIPS and NDcPP
Citrix NetScalerGateway< 14.1-73.37; < 13.1-64.23

References

Timeline

Published
Sep 27, 2026
Last modified
Sep 28, 2026
Added to CISA KEV
Sep 27, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-8877310.0Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler CVE-2026-887747.2Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14CVE-2026-887759.8Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-CVE-2026-887769.8Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37,CVE-2026-887779.8Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37CVE-2026-887787.5Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: beCVE-2026-887797.5Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS,CVE-2026-88787.5Version 3.0.7 of the Securly Chrome Extension exposes multiple publicly accessible endpoints that allow unauthenticated access to sensitive CVE-2026-887826.8The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a CVE-2026-887838.8The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so tCVE-2026-887847.5The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting linCVE-2026-887854.7The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL quer