Citrix NetScaler zero-days exploited, then a new SAML flaw

Exploited Citrix NetScaler flaws CVE-2026-88771, CVE-2026-88772, and later CVE-2026-88779 prompted CISA KEV deadlines and urgent patching.

Citrix issued weekend patches for eight NetScaler ADC and Gateway vulnerabilities, including critical zero-days CVE-2026-88771 and CVE-2026-88772, both scored CVSS 9.5. Sources describe CVE-2026-88771 as unauthenticated command execution or pre-authentication command injection on every deployment, and CVE-2026-88772 as a DTLS memory-overflow flaw that can yield remote code execution or denial of service and is enabled by default on VPN virtual servers. CISA put both on its Known Exploited Vulnerabilities catalog, U.S., U.K., and Dutch agencies warned of global attacks, and federal civilian agencies were ordered to remediate by September 30, 2026; cited fixes are 14.1-73.37 and 13.1-64.23 and later, plus listed FIPS and NDcPP builds. Mandiant and Google Threat Intelligence say activity began by early September, with CyberScoop specifying September 3 for CVE-2026-88772, while GreyNoise recorded attempts on September 24 that other reports associate with CVE-2026-88771. Sources disagree on scale and attribution: some Mandiant-based coverage says dozens of victims and that no attribution has been made, while Kevin Beaumont and another researcher cite more than 100 organizations and later reports describe suspected state-sponsored espionage; exposed-host figures also differ, about 42,000 (Censys, under 10% patched) versus about 50,000 (Palo Alto Networks, as of September 27). Intruders used web shells and tunneling tools, including WHIPSHOT and SLAPSHOT, stole configurations, and in LevelBlue’s account created a superuser named sec_monitor; on October 4 CISA added a further exploited bug, CVE-2026-88779, affecting SAML SP or IdP setups and seen on appliances already patched for the earlier flaws, with a federal deadline of October 7.