cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

Citrix NetScaler Zero-Day Exploited to Crash Patched Appliances

· Original article ↗

Summary

Attackers exploited CVE-2026-88779 against NetScaler ADC and Gateway appliances configured for SAML. WatchTowr reproduced it as a denial-of-service flaw that crashes systems; CISA added it to its KEV catalog.

Key points

  • CVE-2026-88779 is a high-severity memory overflow affecting NetScaler ADC and Gateway configured as a SAML SP or IdP.
  • Citrix reported targeted exploitation causing denial of service and service unavailability, with no identified impact to customer-data integrity.
  • Administrators reported reboots even on patched appliances; logs showed authentication requests with shell commands in usernames.
  • A downloaded script allegedly attempted to install web shells, persist through reboots, and upload configuration and backups; execution was not confirmed.
  • WatchTowr reproduced the flaw and said it can crash systems but cannot achieve remote code execution.
  • CISA added CVE-2026-88779 to its KEV catalog on October 4, with a remediation deadline of October 7 for federal agencies.

Article Details

Vulnerability Types
  • Memory overflow
  • Denial of Service (DoS)
Severity
High
Exploitation Status
active
Exploit Availability
unknown
Patch Status
unknown

CVE

CVE-2026-88771The attacks were spotted just days after NetScaler administrators were warned about two actively exploited zero-days, CVE-2026-88771 and CVE-2026-88772, which forced some customers to pull the plug.CVE-2026-88772The attacks were spotted just days after NetScaler administrators were warned about two actively exploited zero-days, CVE-2026-88771 and CVE-2026-88772, which forced some customers to pull the plug.CVE-2026-88779According to Citrix, the new vulnerability, tracked as CVE-2026-88779 and classified as high severity, is a memory overflow issue affecting NetScaler ADC and NetScaler Gateway instances configured as a SAML SP or SAML

People

Kevin BeaumontSecurity researcher who reported seeing exploitation attempts against patched honeypots and a downloaded malware binary on one honeypot.

Vendors

CitrixCitrix NetScaler administrators scrambled over the weekend to protect their appliances after exploitation of a new zero-day vulnerability began.

Products

NetScaler ADCtracked as CVE-2026-88779 and classified as high severity, is a memory overflow issue affecting NetScaler ADC and NetScaler Gateway instances configured as a SAML SP or SAML IdP.NetScaler Gatewayand classified as high severity, is a memory overflow issue affecting NetScaler ADC and NetScaler Gateway instances configured as a SAML SP or SAML IdP.

Related Articles