cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

Citrix Patches NetScaler Zero-Day Exploited in Targeted Denial-of-Service Attacks

· Original article ↗

Summary

Citrix patched CVE-2026-88779, a high-severity NetScaler flaw exploited in targeted attacks that can cause denial of service when affected ADC or Gateway deployments use SAML. CISA added it to the KEV catalog.

Key points

  • CVE-2026-88779 is a memory overflow vulnerability in NetScaler ADC and NetScaler Gateway, rated 8.7 out of 10.
  • Exploitation requires the affected deployment to be configured as a SAML service provider or identity provider.
  • Citrix confirmed targeted attacks against unpatched deployments that can cause denial of service; repeated triggering may leave the service unavailable.
  • Citrix said it has not identified an impact on the integrity of customer data.
  • Citrix released security updates; the article does not specify the fixed versions.
  • Bishop Fox and watchTowr were credited with reporting the vulnerability; watchTowr said it reproduced the flaw after detecting NetScaler honeypot activity.
  • CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, with federal agencies required to patch by October 7, 2026.

Article Details

Vulnerability Types
  • Memory overflow
  • Denial-of-service
Severity
High; CVSS 8.7
Affected Versions
  • Affected supported versions of customer-managed NetScaler ADC and NetScaler Gateway; specific versions are not listed.
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

CVE

CVE-2026-88771The development also follows reports of active exploitation of CVE-2026-88771 and CVE-2026-88772 to plant web shells and tunneling tools on compromised systems.CVE-2026-88772The development also follows reports of active exploitation of CVE-2026-88771 and CVE-2026-88772 to plant web shells and tunneling tools on compromised systems.CVE-2026-88779The vulnerability, tracked as CVE-2026-88779, carries a CVSS score of 8.7 out of 10.0.

Vendors

Bishop FoxCitrix's Cloud Software Group credited Bishop Fox and watchTowr for reporting the vulnerability. In a post shared on X, watchTowr said it has been able to reproduce the security flaw within hours of detecting NetScalerCitrixCitrix has released security updates for a high-severity security flaw in NetScaler ADC and NetScaler Gateway that has been exploited as part of targeted zero-day attacks.watchTowRCitrix's Cloud Software Group credited Bishop Fox and watchTowr for reporting the vulnerability. In a post shared on X, watchTowr said it has been able to reproduce the security flaw within hours of detecting NetScaler

Products

NetScaler ADCCitrix has released security updates for a high-severity security flaw in NetScaler ADC and NetScaler Gateway that has been exploited as part of targeted zero-day attacks.NetScaler GatewayCitrix has released security updates for a high-severity security flaw in NetScaler ADC and NetScaler Gateway that has been exploited as part of targeted zero-day attacks.

Related Articles