CISA Flags Exploited Citrix NetScaler Flaw After Attacks Cause Appliance Crashes

Summary

CISA added CVE-2026-88779 to its exploited-vulnerabilities catalog after targeted attacks caused NetScaler crashes and denial of service. Citrix advises affected on-prem customers to upgrade, check for compromise, and apply mitigation signatures.

Key points

CVE-2026-88779 is a memory overflow flaw that can cause denial of service and repeated NetScaler appliance outages.
Citrix reported targeted attacks against unmitigated deployments; it said it had not identified an impact on customer data integrity.
The issue affects specified NetScaler ADC and Gateway versions and requires an on-prem deployment using SAML with Gateway or AAA functionality.
Citrix recommends upgrading to fixed versions and offers Global Deny List signatures to reduce exposure.
Citrix provides a compromise-checking script, but watchTowr warned it may report false positives for suspicious nobody processes.
CISA directed U.S. federal civilian agencies to address the flaw by October 7 and check for compromise.

Article Details

Vulnerability Types: Memory overflow
Affected Versions: Citrix NetScaler ADC 14.1 before 14.1-73.41
Citrix NetScaler Gateway 14.1 before 14.1-73.41
Citrix NetScaler ADC 13.1 before 13.1-64.28
Citrix NetScaler Gateway 13.1 before 13.1-64.28
Citrix NetScaler ADC FIPS before 14.1-73.41 FIPS
Citrix NetScaler ADC FIPS before 13.1-37.282
Citrix NetScaler ADC NDcPP before 13.1-37.282
Exploitation Status: active
Exploit Availability: unknown
Patch Status: available
Workarounds: Use Global Deny List signatures to reduce exposure while planning an upgrade.