Citrix released emergency fixes for a new NetScaler flaw that is already being exploited against organizations using SAML sign-in on affected appliances. The issue, CVE-2026-88779, is a memory buffer vulnerability in NetScaler ADC and NetScaler Gateway with SAML authentication configured for Gateway or AAA, patched in 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, and 13.1-37.282 for some FIPS/NDcPP deployments. Citrix describes the known impact as denial of service, but administrators observed crash-and-reboot activity and exploit attempts with shell-command payloads, prompting investigation into possible remote code execution.
Why it matters: Organizations using NetScaler for remote access or identity services may be exposed to live attacks right now, especially if SAML is enabled. This is an update-now situation: identify affected deployments, apply Citrix's patched builds, and use the vendor's deny lists as a temporary mitigation only.
2026.10.05
98% relevant
This article is a direct update on the same event, adding details that CVE-2026-88779 is a memory-overflow denial-of-service bug affecting NetScaler ADC and Gateway when configured for SAML, that Citrix issued fixes over the weekend, CISA set a federal patch deadline, and researchers suspect attackers may be using the crash bug to speed exploitation of CVE-2026-88771.
2026.10.05
93% relevant
This article updates the same CVE-2026-88779 event with added details that CISA ordered federal agencies to patch by Wednesday and perform forensic triage, Australia also warned, Citrix says the flaw can cause repeated denial of service on ADC and Gateway appliances, and watchTowr suspects attackers may be crashing devices to speed exploitation of CVE-2026-88771.
info@thehackernews.com (The Hacker News)
2026.10.05
97% relevant
The article appears to cover the same underlying event: a NetScaler zero-day under active, targeted exploitation that affects SAML sign-in and can disrupt affected deployments, adding reporting context that the flaw can knock federated authentication offline.
Eduard Kovacs
2026.10.05
97% relevant
This article updates the same underlying event by adding evidence that attackers hit appliances that had already been patched for the earlier NetScaler zero-days CVE-2026-88771 and CVE-2026-88772, with reports of repeated reboots, shell commands hidden in usernames, possible malware download behavior, and CISA KEV inclusion with a federal deadline.
Lawrence Abrams
2026.10.04
100% relevant
This article establishes a distinct new zero-day event centered on CVE-2026-88779, separate from the previously tracked Citrix NetScaler flaws CVE-2026-88771 and CVE-2026-88772.
← Back to all stories