CISA and Citrix respond to exploited NetScaler flaws

CISA listed exploited NetScaler denial-of-service bug CVE-2026-88779, while earlier critical flaws remain under attack and a newer bug has no known exploitation.

CISA added CVE-2026-88779, a CWE-119 memory-overflow flaw in customer-managed Citrix NetScaler ADC and Gateway, to the Known Exploited Vulnerabilities catalog on October 4, 2026, after active exploitation that can repeatedly crash appliances into denial of service. The Record scores it 8.7; vulnerable on-premises builds include 14.1 before 14.1-73.41 and 13.1 before 13.1-64.28, and federal civilian agencies must remediate by October 7, 2026, under BOD 26-04, with forensic triage rather than patching alone. Sources describe the exposed configurations as SAML with Gateway or AAA, as a SAML service provider or identity provider, or simply as SAML-enabled. Citrix, crediting Bishop Fox and watchTowr, reported targeted attacks with no identified impact on data integrity and published fixes, deny-list signatures, and an indicator script, while other reports describe crash attempts, webshell or malware-download activity, and shellcode that may be aimed at code execution. CyberScoop's headline calls this the third exploited NetScaler zero-day in less than a week, but its summary says under two weeks, and it says exploitation likely began Friday. Separately, critical pre-authentication command-injection flaw CVE-2026-88771 (CVSS 9.5) and CVE-2026-88772 remain under active exploitation after Citrix's September 27, 2026 bulletin, with fixes in 14.1-73.37 and 13.1-64.23; LevelBlue reported reverse shells, payloads, a PHP web shell, superuser sec_monitor, and ns.conf theft, Mandiant cited likely victims in North America and Europe, and a SOCRadar headline alleged a large command-and-control operation whose supplied text is truncated. Citrix later patched CVE-2026-107406, a CVSS 9.5 memory overflow that can allow remote code execution or denial of service on SAML SP or IdP appliances, in 14.1-73.46 and 13.1-64.29 and later, and said it is not aware of exploitation.