Story · 1 source · 1 articlefirst Oct 3, 05:51 UTCupdated Oct 3, 05:51 UTC (8d ago)

Citrix patches exploited NetScaler SAML flaw CVE-2026-88779

criticalExploit / PoCexploited in the wildimportance 93CVE-2026-88779 CVE-2026-88771 CVE-2026-88772 CVE-2025-6543 CVE-2026-8452

What's new: First coverage.

Merged summary · grok-4.7 · rewritten as coverage arrives

Citrix patched exploited NetScaler ADC and Gateway flaw CVE-2026-88779, a CVSS 8.7 SAML memory overflow linked to denial of service, as CISA set an October 7 deadline.

Citrix issued emergency updates for CVE-2026-88779, a CVSS 8.7 memory-buffer overflow in customer-managed NetScaler ADC and Gateway appliances configured as a SAML service provider or identity provider, or with SAML Gateway or AAA. Citrix said targeted attacks caused denial of service on unmitigated appliances and that data integrity was not affected, and it shipped fixes including 14.1-73.41 and 13.1-64.28 plus FIPS builds, deny-list signatures, and an indicator script, crediting watchTowr and Bishop Fox. CISA added the flaw to the Known Exploited Vulnerabilities catalog on October 4, 2026, and ordered U.S. federal agencies to mitigate by October 7 and conduct forensic triage; Canada's Cyber Centre issued advisory AV26-996 on October 5, and Australian authorities also warned customers. SecurityWeek said exploitation hit appliances patched days earlier and called this the sixth exploited NetScaler flaw added to KEV in 2026, while other reports described attacks on unpatched or unmitigated systems; researchers including Kevin Beaumont reported crash loops, commands hidden in usernames, webshell attempts, and a downloaded malware binary, so accounts disagree on remote code execution and patched-appliance impact. Separately, CVE-2026-88771, a CVSS 9.5 pre-authentication command-injection flaw patched on September 27 in 14.1-73.37 and 13.1-64.23, and CVE-2026-88772 remain under active exploitation, with LevelBlue reporting reverse shells, superuser sec_monitor, ns.conf theft, and a PHP web shell, and Mandiant citing likely victims across government, finance, technology, education, and legal services in North America and Europe.

CVE-2026-88779 is a CVSS 8.7 memory-buffer overflow in customer-managed Citrix NetScaler ADC and Gateway appliances configured as a SAML service provider or identity provider, or with SAML Gateway or AAA.
Fixed releases cited include 14.1-73.41 and 13.1-64.28, with matching FIPS builds; Canada's Cyber Centre said affected ADC builds are those before 13.1-37.282, 13.1-64.28, and 14.1-73.41, and Gateway builds before 13.1-64.28 and 14.1-73.41.
CISA added CVE-2026-88779 to the KEV catalog on October 4, 2026, and ordered U.S. federal agencies to mitigate by October 7 and perform forensic triage; SecurityWeek called it the sixth exploited NetScaler flaw added to KEV in 2026.
Citrix reported targeted denial-of-service attacks on unmitigated appliances, said data integrity was unaffected, published deny-list signatures and an indicator script, and credited watchTowr and Bishop Fox.

VendorsCitrix

ProductsNetScaler ADC NetScaler Gateway NetScaler

OrganizationsCitrix CISA Kevin Beaumont LevelBlue Bishop Fox watchTowr Geico watchTowr Labs Mandiant Google Canadian Centre for Cyber Security Cloud Software Group

CountriesUnited States Australia Canada

Coverage timelineoldest first · each row is one article

Oct 3, 05:51 UTC · 8d ago
GBHackers· 76
Citrix NetScaler Appliances Reboot Repeatedly After 0-Day Security Update
Patched Citrix NetScaler appliances crash and reboot when malformed SAML requests hit the nsaaad service.

Vulnerabilities in this storyAll →

CVE-2025-65439.211%
Memory Buffer Overflow in Citrix NetScaler ADC and Gateway Exploited in the Wild
published Jun 25, 2025· Citrix NetScaler ADC KEV
CVE-2026-84528.8

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2025-6543	Memory Buffer Overflow in Citrix NetScaler ADC and Gateway Exploited in the Wild Citrix NetScaler ADC and NetScaler Gateway appliances contain a memory buffer overflow (CWE-119) that can lead to unintended control flow and denial of service. The flaw is only reachable when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server, and it is network-exploitable without authentication or user interaction, though attack complexity is rated high. A successful attacker could achieve unintended control flow — with the CVSS 4.0 vector rating impact high across confidentiality, integrity, and availability — or crash the appliance, disrupting VPN access and application delivery. Any organization running NetScaler ADC or NetScaler Gateway in an affected Gateway/AAA configuration is exposed, a population that public scan data places in the tens of thousands of internet-exposed devices. The vulnerability was added to CISA's KEV catalog on 2025-06-30, confirming exploitation in the wild, with EPSS at 10.1% and no public proof-of-concept known. Do: Apply the patched NetScaler release specified in Citrix's security bulletin for CVE-2025-6543 immediately, prioritizing appliances in Gateway or AAA configurations, per CISA KEV and BOD 22-01 requirements. Audit which virtual servers (VPN, ICA Proxy, CVPN, RDP Proxy, AAA) are in use and whether they are internet-exposed, and check appliances for signs of compromise before and after upgrading.	9.2	11%	KEV	Citrix NetScaler ADC Citrix NetScaler Gateway	large≈50,000+ internet-exposed NetScaler ADC/Gateway devices (only Gateway/AAA configurations vulnerable)	Jun 25, 2025 KEV Jun 30, 2025
CVE-2026-8452	Memory Buffer Overflow in Citrix NetScaler ADC/Gateway Exploited in the Wild CVE-2026-8452 is a memory buffer overflow (CWE-119) in Citrix NetScaler ADC and NetScaler Gateway that applies when the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. The flaw is reachable over the network without authentication (CVSS 4.0: AV:N/PR:N), so an unauthenticated attacker can trigger it remotely. Successful exploitation causes unpredictable or erroneous appliance behavior and denial of service, and the high confidentiality score suggests possible disclosure of memory contents; some reporting suggests pre-authentication remote code execution may be possible, though the vendor description emphasizes DoS. Organizations running affected NetScaler appliances in a Gateway or AAA role — a very common configuration for remote access to Citrix virtual apps and desktops — are potentially exposed. The flaw was added to CISA's KEV catalog on 2026-08-26 and is reported as exploited in the wild, with headlines noting the flaw was already patched before exploitation was confirmed. Do: Upgrade NetScaler ADC and Gateway to the fixed releases identified in Citrix security advisory AV26-645 (Update 3); no fixed version numbers were included in this data, so consult the advisory directly. Prioritize any appliance with an internet-exposed Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server, and given the KEV listing and reports of exploitation, perform log and forensics review for signs of prior compromise per CISA's Forensics Triage Requirements — federal agencies must comply with BOD 26-04 timelines. Where patching cannot happen immediately, restrict or disable exposed Gateway/AAA configurations as an interim mitigation.	8.8	1%	KEV PoC
CVE-2026-88772 +1 related CVE CVE-2026-88771	Unauthenticated RCE/DoS in Citrix NetScaler ADC and Gateway CVE-2026-88772 is a critical flaw in Citrix NetScaler ADC and NetScaler Gateway that can lead to remote code execution or denial of service. It is reachable over the network with no privileges and no user interaction, though attack complexity is rated high; successful exploitation can fully compromise the appliance and affect systems behind it. Affected builds are ADC before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP, and Gateway before 14.1-73.37 and before 13.1-64.23. Organizations running those releases as internet-facing ADC or VPN gateways are at risk. Citrix-linked reporting describes active zero-day exploitation; no public proof-of-concept is known and the issue is not listed in CISA KEV. Do: Upgrade NetScaler ADC and Gateway to 14.1-73.37 or 13.1-64.23 (or later), and FIPS/NDcPP ADC builds to 14.1-73.37 FIPS or 13.1.37.279 FIPS and NDcPP (or later). Treat unpatched internet-facing appliances as potentially compromised: review admin and VPN logs, config changes, and unusual processes, and restrict management interfaces until patched.	9.5	1%	KEV PoC ×2
CVE-2026-88779	Unauthenticated denial of service in NetScaler ADC and Gateway CVE-2026-88779 is a high-severity vulnerability (CVSS 4.0 base score 8.7) in Citrix NetScaler ADC and NetScaler Gateway. CVSS metrics indicate it can be triggered remotely over the network with low complexity, no privileges, and no user interaction; the advisory text does not name a specific bug class or request path. Impact is limited to high loss of availability on the vulnerable appliance, with no confidentiality or integrity impact scored for the device or for subsequent systems, which is consistent with denial of service. Affected products are NetScaler ADC before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282, and NetScaler Gateway before 14.1-73.41 and before 13.1-64.28. It is not listed in CISA KEV, and no public proof-of-concept is known. Do: Upgrade NetScaler ADC to 14.1-73.41 or later, 13.1-64.28 or later, 14.1-73.41 FIPS or later, or 13.1-37.282 or later, and NetScaler Gateway to 14.1-73.41 or 13.1-64.28 or later, matching the correct non-FIPS or FIPS train. Until those builds are in place, restrict ADC and Gateway services to trusted networks and monitor for unexpected restarts or loss of availability.	8.7	<1%	KEV	Citrix NetScaler ADC before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282 Citrix NetScaler Gateway before 14.1-73.41 and before 13.1-64.28

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2025-6543

Memory Buffer Overflow in Citrix NetScaler ADC and Gateway Exploited in the Wild

Citrix NetScaler ADC and NetScaler Gateway appliances contain a memory buffer overflow (CWE-119) that can lead to unintended control flow and denial of service. The flaw is only reachable when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server, and it is network-exploitable without authentication or user interaction, though attack complexity is rated high. A successful attacker could achieve unintended control flow — with the CVSS 4.0 vector rating impact high across confidentiality, integrity, and availability — or crash the appliance, disrupting VPN access and application delivery. Any organization running NetScaler ADC or NetScaler Gateway in an affected Gateway/AAA configuration is exposed, a population that public scan data places in the tens of thousands of internet-exposed devices. The vulnerability was added to CISA's KEV catalog on 2025-06-30, confirming exploitation in the wild, with EPSS at 10.1% and no public proof-of-concept known.

Do: Apply the patched NetScaler release specified in Citrix's security bulletin for CVE-2025-6543 immediately, prioritizing appliances in Gateway or AAA configurations, per CISA KEV and BOD 22-01 requirements. Audit which virtual servers (VPN, ICA Proxy, CVPN, RDP Proxy, AAA) are in use and whether they are internet-exposed, and check appliances for signs of compromise before and after upgrading.

9.2

11%

KEV

Citrix NetScaler ADC
Citrix NetScaler Gateway

large≈50,000+ internet-exposed NetScaler ADC/Gateway devices (only Gateway/AAA configurations vulnerable)

Jun 25, 2025

KEV Jun 30, 2025

CVE-2026-8452

Memory Buffer Overflow in Citrix NetScaler ADC/Gateway Exploited in the Wild

CVE-2026-8452 is a memory buffer overflow (CWE-119) in Citrix NetScaler ADC and NetScaler Gateway that applies when the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. The flaw is reachable over the network without authentication (CVSS 4.0: AV:N/PR:N), so an unauthenticated attacker can trigger it remotely. Successful exploitation causes unpredictable or erroneous appliance behavior and denial of service, and the high confidentiality score suggests possible disclosure of memory contents; some reporting suggests pre-authentication remote code execution may be possible, though the vendor description emphasizes DoS. Organizations running affected NetScaler appliances in a Gateway or AAA role — a very common configuration for remote access to Citrix virtual apps and desktops — are potentially exposed. The flaw was added to CISA's KEV catalog on 2026-08-26 and is reported as exploited in the wild, with headlines noting the flaw was already patched before exploitation was confirmed.

Do: Upgrade NetScaler ADC and Gateway to the fixed releases identified in Citrix security advisory AV26-645 (Update 3); no fixed version numbers were included in this data, so consult the advisory directly. Prioritize any appliance with an internet-exposed Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server, and given the KEV listing and reports of exploitation, perform log and forensics review for signs of prior compromise per CISA's Forensics Triage Requirements — federal agencies must comply with BOD 26-04 timelines. Where patching cannot happen immediately, restrict or disable exposed Gateway/AAA configurations as an interim mitigation.

8.8

KEV PoC

CVE-2026-88772

+1 related CVE

CVE-2026-88771

Unauthenticated RCE/DoS in Citrix NetScaler ADC and Gateway

CVE-2026-88772 is a critical flaw in Citrix NetScaler ADC and NetScaler Gateway that can lead to remote code execution or denial of service. It is reachable over the network with no privileges and no user interaction, though attack complexity is rated high; successful exploitation can fully compromise the appliance and affect systems behind it. Affected builds are ADC before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP, and Gateway before 14.1-73.37 and before 13.1-64.23. Organizations running those releases as internet-facing ADC or VPN gateways are at risk. Citrix-linked reporting describes active zero-day exploitation; no public proof-of-concept is known and the issue is not listed in CISA KEV.

Do: Upgrade NetScaler ADC and Gateway to 14.1-73.37 or 13.1-64.23 (or later), and FIPS/NDcPP ADC builds to 14.1-73.37 FIPS or 13.1.37.279 FIPS and NDcPP (or later). Treat unpatched internet-facing appliances as potentially compromised: review admin and VPN logs, config changes, and unusual processes, and restrict management interfaces until patched.

9.5

KEV PoC ×2

CVE-2026-88779

Unauthenticated denial of service in NetScaler ADC and Gateway

CVE-2026-88779 is a high-severity vulnerability (CVSS 4.0 base score 8.7) in Citrix NetScaler ADC and NetScaler Gateway. CVSS metrics indicate it can be triggered remotely over the network with low complexity, no privileges, and no user interaction; the advisory text does not name a specific bug class or request path. Impact is limited to high loss of availability on the vulnerable appliance, with no confidentiality or integrity impact scored for the device or for subsequent systems, which is consistent with denial of service. Affected products are NetScaler ADC before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282, and NetScaler Gateway before 14.1-73.41 and before 13.1-64.28. It is not listed in CISA KEV, and no public proof-of-concept is known.

Do: Upgrade NetScaler ADC to 14.1-73.41 or later, 13.1-64.28 or later, 14.1-73.41 FIPS or later, or 13.1-37.282 or later, and NetScaler Gateway to 14.1-73.41 or 13.1-64.28 or later, matching the correct non-FIPS or FIPS train. Until those builds are in place, restrict ADC and Gateway services to trusted networks and monitor for unexpected restarts or loss of availability.

8.7

<1%

KEV

Citrix NetScaler ADC before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282
Citrix NetScaler Gateway before 14.1-73.41 and before 13.1-64.28