Story · 15 sources · 22 articlesfirst Oct 3, 02:41 UTCupdated Oct 8, 12:55 UTC (12h ago)

Citrix NetScaler zero-days stay exploited after emergency patches

criticalExploit / PoCexploited in the wildimportance 93CVE-2026-88779 CVE-2026-88771 CVE-2026-88772 CVE-2025-6543 CVE-2026-8452

What's new: October 8 LevelBlue reports add that CVE-2026-88771 exploitation used Perl and Python payloads, installed a PHP web shell, created superuser sec_monitor, and stole ns.conf, and they list September 27 fixes 14.1-73.37 and 13.1-64.23 with FIPS and NDcPP builds. They also say failed logins do not rule out successful injection and point defenders to altered customsnmpd, .local_journal, and outbound…

Merged summary · grok-4.7 · rewritten as coverage arrives

Actively exploited Citrix NetScaler flaws CVE-2026-88779 and CVE-2026-88771 drew emergency patches and a CISA deadline of October 7.

Citrix issued emergency updates for CVE-2026-88779, a CVSS 8.7 memory-buffer overflow in customer-managed NetScaler ADC and Gateway appliances that use SAML, described variously as Gateway or AAA configurations or as a SAML service provider or identity provider. Citrix said targeted attacks on unmitigated appliances caused denial of service, including repeated outages, and that it found no impact on data integrity; SecurityWeek, BleepingComputer, and honeypot reporting instead describe possible code execution, webshell attempts, a downloaded malware binary, and activity against already patched honeypots, including a binary Kevin Beaumont observed and a payload from 213.209.159.55. Cited fixes are 14.1-73.41 and 13.1-64.28 plus FIPS builds, while Canada's October 5 advisory AV26-996 also lists ADC releases before 13.1-37.282; Citrix published deny-list signatures and an indicator script and credited Bishop Fox and watchTowr. CISA added the bug to the Known Exploited Vulnerabilities catalog on October 4, 2026, which SecurityWeek called the sixth exploited NetScaler CVE listed in 2026, and told U.S. federal agencies to mitigate by October 7 and perform forensic triage, alongside U.S. and Australian warnings. Separately, CVE-2026-88771, a CVSS 9.5 pre-authentication command-injection flaw patched September 27 in 14.1-73.37 and 13.1-64.23 including FIPS and NDcPP builds, and CVE-2026-88772 remain under active exploitation; October 8 LevelBlue reporting describes reverse shells, a PHP web shell, creation of superuser sec_monitor, and theft of ns.conf, while Mandiant cited likely victims in North America and Europe and Infosecurity noted KEV-listed CVE-2026-8452.

CVE-2026-88779 is a CVSS 8.7 memory-overflow flaw in customer-managed NetScaler ADC and Gateway using SAML (described as Gateway/AAA or as a SAML SP or IdP); cited fixes are 14.1-73.41 and 13.1-64.28 plus FIPS builds, and Canada's AV26-996…
Citrix said targeted attacks on unmitigated appliances caused denial of service and that data integrity was unaffected; SecurityWeek, BleepingComputer, and honeypot reports instead describe possible code execution, webshell attempts, a…
CISA added CVE-2026-88779 to the KEV catalog on October 4, 2026—the sixth exploited NetScaler CVE it listed in 2026, per SecurityWeek—and ordered U.S. federal agencies to mitigate by October 7 and do forensic triage; the U.S. and Australia…
Citrix published deny-list signatures and an indicator script and credited Bishop Fox and watchTowr; watchTowr said one crafted request can take an appliance offline.

VendorsCitrix

ProductsNetScaler ADC NetScaler Gateway NetScaler

OrganizationsCitrix CISA Kevin Beaumont LevelBlue Bishop Fox watchTowr Geico watchTowr Labs Mandiant Google Canadian Centre for Cyber Security Cloud Software Group

CountriesUnited States Australia Canada

Coverage timelineoldest first · each row is one article

Oct 3, 02:41 UTC · 5d ago
Cyber Security News· 76
Citrix NetScaler Keeps Rebooting Following the 0-Day Patch
Citrix NetScaler appliances on zero-day fix 14.1-73.37 reboot after crafted SAML traffic crashes nsaaad.
Oct 3, 05:51 UTC · 5d ago
GBHackers· 76
Citrix NetScaler Appliances Reboot Repeatedly After 0-Day Security Update
Patched Citrix NetScaler appliances crash and reboot when malformed SAML requests hit the nsaaad service.
Oct 4, 21:58 UTC · 4d ago
BleepingComputer· 88
Citrix patches NetScaler SAML zero-day exploited in attacks
Citrix patched actively exploited NetScaler SAML zero-day CVE-2026-88779 after crashes and possible code execution.

Vulnerabilities in this storyAll →

CVE-2025-65439.211%
Memory Buffer Overflow in Citrix NetScaler ADC and Gateway Exploited in the Wild
published Jun 25, 2025· Citrix NetScaler ADC KEV
CVE-2026-84528.8

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2025-6543	Memory Buffer Overflow in Citrix NetScaler ADC and Gateway Exploited in the Wild Citrix NetScaler ADC and NetScaler Gateway appliances contain a memory buffer overflow (CWE-119) that can lead to unintended control flow and denial of service. The flaw is only reachable when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server, and it is network-exploitable without authentication or user interaction, though attack complexity is rated high. A successful attacker could achieve unintended control flow — with the CVSS 4.0 vector rating impact high across confidentiality, integrity, and availability — or crash the appliance, disrupting VPN access and application delivery. Any organization running NetScaler ADC or NetScaler Gateway in an affected Gateway/AAA configuration is exposed, a population that public scan data places in the tens of thousands of internet-exposed devices. The vulnerability was added to CISA's KEV catalog on 2025-06-30, confirming exploitation in the wild, with EPSS at 10.1% and no public proof-of-concept known. Do: Apply the patched NetScaler release specified in Citrix's security bulletin for CVE-2025-6543 immediately, prioritizing appliances in Gateway or AAA configurations, per CISA KEV and BOD 22-01 requirements. Audit which virtual servers (VPN, ICA Proxy, CVPN, RDP Proxy, AAA) are in use and whether they are internet-exposed, and check appliances for signs of compromise before and after upgrading.	9.2	11%	KEV	Citrix NetScaler ADC Citrix NetScaler Gateway	large≈50,000+ internet-exposed NetScaler ADC/Gateway devices (only Gateway/AAA configurations vulnerable)	Jun 25, 2025 KEV Jun 30, 2025
CVE-2026-8452	Memory Buffer Overflow in Citrix NetScaler ADC/Gateway Exploited in the Wild CVE-2026-8452 is a memory buffer overflow (CWE-119) in Citrix NetScaler ADC and NetScaler Gateway that applies when the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. The flaw is reachable over the network without authentication (CVSS 4.0: AV:N/PR:N), so an unauthenticated attacker can trigger it remotely. Successful exploitation causes unpredictable or erroneous appliance behavior and denial of service, and the high confidentiality score suggests possible disclosure of memory contents; some reporting suggests pre-authentication remote code execution may be possible, though the vendor description emphasizes DoS. Organizations running affected NetScaler appliances in a Gateway or AAA role — a very common configuration for remote access to Citrix virtual apps and desktops — are potentially exposed. The flaw was added to CISA's KEV catalog on 2026-08-26 and is reported as exploited in the wild, with headlines noting the flaw was already patched before exploitation was confirmed. Do: Upgrade NetScaler ADC and Gateway to the fixed releases identified in Citrix security advisory AV26-645 (Update 3); no fixed version numbers were included in this data, so consult the advisory directly. Prioritize any appliance with an internet-exposed Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server, and given the KEV listing and reports of exploitation, perform log and forensics review for signs of prior compromise per CISA's Forensics Triage Requirements — federal agencies must comply with BOD 26-04 timelines. Where patching cannot happen immediately, restrict or disable exposed Gateway/AAA configurations as an interim mitigation.	8.8	1%	KEV PoC
CVE-2026-88772 +1 related CVE CVE-2026-88771	Unauthenticated RCE/DoS in Citrix NetScaler ADC and Gateway CVE-2026-88772 is a critical flaw in Citrix NetScaler ADC and NetScaler Gateway that can lead to remote code execution or denial of service. It is reachable over the network with no privileges and no user interaction, though attack complexity is rated high; successful exploitation can fully compromise the appliance and affect systems behind it. Affected builds are ADC before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP, and Gateway before 14.1-73.37 and before 13.1-64.23. Organizations running those releases as internet-facing ADC or VPN gateways are at risk. Citrix-linked reporting describes active zero-day exploitation; no public proof-of-concept is known and the issue is not listed in CISA KEV. Do: Upgrade NetScaler ADC and Gateway to 14.1-73.37 or 13.1-64.23 (or later), and FIPS/NDcPP ADC builds to 14.1-73.37 FIPS or 13.1.37.279 FIPS and NDcPP (or later). Treat unpatched internet-facing appliances as potentially compromised: review admin and VPN logs, config changes, and unusual processes, and restrict management interfaces until patched.	9.5	1%	KEV PoC ×2
CVE-2026-88779	Unauthenticated denial of service in NetScaler ADC and Gateway CVE-2026-88779 is a high-severity vulnerability (CVSS 4.0 base score 8.7) in Citrix NetScaler ADC and NetScaler Gateway. CVSS metrics indicate it can be triggered remotely over the network with low complexity, no privileges, and no user interaction; the advisory text does not name a specific bug class or request path. Impact is limited to high loss of availability on the vulnerable appliance, with no confidentiality or integrity impact scored for the device or for subsequent systems, which is consistent with denial of service. Affected products are NetScaler ADC before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282, and NetScaler Gateway before 14.1-73.41 and before 13.1-64.28. It is not listed in CISA KEV, and no public proof-of-concept is known. Do: Upgrade NetScaler ADC to 14.1-73.41 or later, 13.1-64.28 or later, 14.1-73.41 FIPS or later, or 13.1-37.282 or later, and NetScaler Gateway to 14.1-73.41 or 13.1-64.28 or later, matching the correct non-FIPS or FIPS train. Until those builds are in place, restrict ADC and Gateway services to trusted networks and monitor for unexpected restarts or loss of availability.	8.7	<1%	KEV	Citrix NetScaler ADC before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282 Citrix NetScaler Gateway before 14.1-73.41 and before 13.1-64.28

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2025-6543

Memory Buffer Overflow in Citrix NetScaler ADC and Gateway Exploited in the Wild

Citrix NetScaler ADC and NetScaler Gateway appliances contain a memory buffer overflow (CWE-119) that can lead to unintended control flow and denial of service. The flaw is only reachable when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server, and it is network-exploitable without authentication or user interaction, though attack complexity is rated high. A successful attacker could achieve unintended control flow — with the CVSS 4.0 vector rating impact high across confidentiality, integrity, and availability — or crash the appliance, disrupting VPN access and application delivery. Any organization running NetScaler ADC or NetScaler Gateway in an affected Gateway/AAA configuration is exposed, a population that public scan data places in the tens of thousands of internet-exposed devices. The vulnerability was added to CISA's KEV catalog on 2025-06-30, confirming exploitation in the wild, with EPSS at 10.1% and no public proof-of-concept known.

Do: Apply the patched NetScaler release specified in Citrix's security bulletin for CVE-2025-6543 immediately, prioritizing appliances in Gateway or AAA configurations, per CISA KEV and BOD 22-01 requirements. Audit which virtual servers (VPN, ICA Proxy, CVPN, RDP Proxy, AAA) are in use and whether they are internet-exposed, and check appliances for signs of compromise before and after upgrading.

9.2

11%

KEV

Citrix NetScaler ADC
Citrix NetScaler Gateway

large≈50,000+ internet-exposed NetScaler ADC/Gateway devices (only Gateway/AAA configurations vulnerable)

Jun 25, 2025

KEV Jun 30, 2025

CVE-2026-8452

Memory Buffer Overflow in Citrix NetScaler ADC/Gateway Exploited in the Wild

CVE-2026-8452 is a memory buffer overflow (CWE-119) in Citrix NetScaler ADC and NetScaler Gateway that applies when the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. The flaw is reachable over the network without authentication (CVSS 4.0: AV:N/PR:N), so an unauthenticated attacker can trigger it remotely. Successful exploitation causes unpredictable or erroneous appliance behavior and denial of service, and the high confidentiality score suggests possible disclosure of memory contents; some reporting suggests pre-authentication remote code execution may be possible, though the vendor description emphasizes DoS. Organizations running affected NetScaler appliances in a Gateway or AAA role — a very common configuration for remote access to Citrix virtual apps and desktops — are potentially exposed. The flaw was added to CISA's KEV catalog on 2026-08-26 and is reported as exploited in the wild, with headlines noting the flaw was already patched before exploitation was confirmed.

Do: Upgrade NetScaler ADC and Gateway to the fixed releases identified in Citrix security advisory AV26-645 (Update 3); no fixed version numbers were included in this data, so consult the advisory directly. Prioritize any appliance with an internet-exposed Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server, and given the KEV listing and reports of exploitation, perform log and forensics review for signs of prior compromise per CISA's Forensics Triage Requirements — federal agencies must comply with BOD 26-04 timelines. Where patching cannot happen immediately, restrict or disable exposed Gateway/AAA configurations as an interim mitigation.

8.8

KEV PoC

CVE-2026-88772

+1 related CVE

CVE-2026-88771

Unauthenticated RCE/DoS in Citrix NetScaler ADC and Gateway

CVE-2026-88772 is a critical flaw in Citrix NetScaler ADC and NetScaler Gateway that can lead to remote code execution or denial of service. It is reachable over the network with no privileges and no user interaction, though attack complexity is rated high; successful exploitation can fully compromise the appliance and affect systems behind it. Affected builds are ADC before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP, and Gateway before 14.1-73.37 and before 13.1-64.23. Organizations running those releases as internet-facing ADC or VPN gateways are at risk. Citrix-linked reporting describes active zero-day exploitation; no public proof-of-concept is known and the issue is not listed in CISA KEV.

Do: Upgrade NetScaler ADC and Gateway to 14.1-73.37 or 13.1-64.23 (or later), and FIPS/NDcPP ADC builds to 14.1-73.37 FIPS or 13.1.37.279 FIPS and NDcPP (or later). Treat unpatched internet-facing appliances as potentially compromised: review admin and VPN logs, config changes, and unusual processes, and restrict management interfaces until patched.

9.5

KEV PoC ×2

CVE-2026-88779

Unauthenticated denial of service in NetScaler ADC and Gateway

CVE-2026-88779 is a high-severity vulnerability (CVSS 4.0 base score 8.7) in Citrix NetScaler ADC and NetScaler Gateway. CVSS metrics indicate it can be triggered remotely over the network with low complexity, no privileges, and no user interaction; the advisory text does not name a specific bug class or request path. Impact is limited to high loss of availability on the vulnerable appliance, with no confidentiality or integrity impact scored for the device or for subsequent systems, which is consistent with denial of service. Affected products are NetScaler ADC before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282, and NetScaler Gateway before 14.1-73.41 and before 13.1-64.28. It is not listed in CISA KEV, and no public proof-of-concept is known.

Do: Upgrade NetScaler ADC to 14.1-73.41 or later, 13.1-64.28 or later, 14.1-73.41 FIPS or later, or 13.1-37.282 or later, and NetScaler Gateway to 14.1-73.41 or 13.1-64.28 or later, matching the correct non-FIPS or FIPS train. Until those builds are in place, restrict ADC and Gateway services to trusted networks and monitor for unexpected restarts or loss of availability.

8.7

<1%

KEV

Citrix NetScaler ADC before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282
Citrix NetScaler Gateway before 14.1-73.41 and before 13.1-64.28