Citrix Patches Actively Exploited NetScaler Zero-Day Causing Denial of Service
Summary
Citrix patched CVE-2026-88779, an actively exploited NetScaler flaw affecting SAML configurations and causing denial of service. Researchers are investigating possible code execution; CISA added it to its KEV catalog.
Key points
- CVE-2026-88779 is a memory buffer flaw affecting NetScaler ADC and Gateway appliances configured for SAML authentication.
- Citrix reports targeted exploitation causing denial of service; repeated triggers may keep services unavailable.
- Citrix released emergency updates for affected NetScaler versions and recommends installing them promptly; Global Deny Lists are also available.
- Researchers are investigating whether exploitation can achieve remote code execution; reports of attempted commands do not by themselves confirm successful execution.
- CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and set an October 7 mitigation deadline for FCEB agencies.
Article Details
- Vulnerability Types
- Memory buffer flaw
- Severity
- CVSS 8.7
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Citrix-provided Global Deny Lists can block access from known malicious IP addresses.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 213[.]209[.]159[.]55 | IP address from which crafted authentication requests reportedly attempted to download a payload. |
MITRE ATT&CK
T1059.004 · Unix ShellThe crafted usernames reportedly contained shell commands to download and execute a payload; successful execution was not confirmed in those logs.T1105 · Ingress Tool TransferCrafted authentication usernames reportedly contained commands to download a payload from 213.209.159[.]55.
CVE
CVE-2025-6543“Memory overflow vulnerability leading to Denial of Service,” similar to how the previously disclosed CVE-2025-6543 was initially characterized before later attacks showed it could be used for remote code execution.CVE-2026-88779Citrix has released emergency updates for CVE-2026-88779, a zero-day NetScaler memory buffer flaw that is being exploited in targeted attacks to cause denial of service, with researchers also probing whether it can lead
People
Vendors
Products
NetScaler ADCThe issue affects NetScaler ADC and NetScaler Gateway appliances using SAML authentication, and CISA has added it to its Known Exploited Vulnerabilities catalog.NetScaler GatewayThe issue affects NetScaler ADC and NetScaler Gateway appliances using SAML authentication, and CISA has added it to its Known Exploited Vulnerabilities catalog.