Actively Exploited Citrix NetScaler ADC and NetScaler Gateway Vulnerability (CVE-2026-88779)

The Threat

On October 4th, 2026, Citrix disclosed the zero-day vulnerability CVE-2026-88779, impacting NetScaler ADC and NetScaler Gateway deployments. CVE-2026-88779 (CVSS: 8.7) is a memory overflow vulnerability impacting NetScaler ADC and NetScaler Gateway "under specific deployment conditions" that can lead to Denial of Service (DoS). Pre-conditions require that NetScaler deployments use SAML authentication (SAML service provider [SP] or SAML identity provider [IdP]) in conjunction with Gateway or AAA functionality.

Citrix states that they have observed "targeted attacks on unmitigated NetScaler deployments". Unconfirmed reporting has suggested that exploitation of the flaw led to Remote Code Execution (RCE). Patches have been released to address CVE-2026-88779; as exploitation is ongoing, organizations should ensure that relevant patches are applied as soon as possible.

What we're doing about it

• eSentire's Managed Vulnerability Service (MVS) will add relevant plugins as they become available
• eSentire customers can employ the Vulnerabilities and Inferred Vulnerabilities pages in Atlas Portal to search for potentially vulnerable assets
• eSentire's Threat Response Unit (TRU) is tracking this topic for additional information and detection opportunities

What you should do about it

• After performing a business impact review, apply the relevant security patches immediately
• Organizations that have NetScaler deployed as a Gateway or AAA virtual server should review NetScaler configurations to determine if SAML authentication actions are configured
  • Inspect NetScaler configurations for entries matching the following to determine if NetScaler deployments meet the required preconditions:
    • add authentication samlAction (Appliance is configured as a SAML SP)
    • add authentication samlIdPProfile (Appliance is configured as a SAML IdP)
• Apply Global Deny List signatures released by Citrix to reduce exposure while patches are applied

Additional information

On October 2nd, Citrix published a security update, stating that there was a "newly observed issue" relating to SAML authentication in NetScaler deployments. By October 4th, Citrix confirmed that "targeted attacks" had been observed, but no additional details were shared. CISA added CVE-2026-88779 to its Known Exploited Vulnerabilities (KEV) catalog on October 4th, giving Federal Civilian Executive Branch (FCEB) agencies a deadline of October 7th to apply relevant patches.

Following Citrix's initial update, watchTowr Labs claimed that they were "tracking rumors" and "honeypot activity" relating to a new vulnerability impacting NetScaler appliances, later claiming to have "successfully reproduced" the vulnerability. It is likely that watchTowr Labs will publish further technical details, and possibly a Proof-of-Concept (PoC) exploit, for CVE-2026-88779 in the near future, which could lower the barrier for exploitation. Further reporting on the flaw suggests that although it is characterized as a DoS, CVE-2026-88779 was escalated to achieve Remote Code Execution (RCE) and payload deployment through specially crafted authentication requests containing shell commands.

The disclosure of CVE-2026-88779 comes shortly after two other zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772) in NetScaler ADC and NetScaler Gateway were reported. Widespread exploitation of these flaws was observed within days of their identification, demonstrating a history of NetScaler appliances being targeted within attacks. As exploitation of CVE-2026-88779 is ongoing, organizations should ensure that relevant patches are applied as soon as possible. If patching cannot immediately be applied, Citrix has released Global Deny List signatures, which can be used to "reduce exposure" while awaiting upgrades.

Fixed Versions

• NetScaler ADC and NetScaler Gateway 14.1 to 14.1-73.41 or later
• NetScaler ADC and NetScaler Gateway 13.1 to 13.1-64.28 or later
• NetScaler ADC 14.1-FIPS to 14.1-73.41 FIPS or later
• NetScaler ADC 13.1-FIPS and 13.1-NDcPP to 13.1-37.282 or later

References

[1] https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174
[2] https://nvd.nist.gov/vuln/detail/cve-2026-88779
[3] https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/
[4] https://aviatrix.ai/threat-research-center/citrix-netscaler-saml-zero-day-cve-2026-88779-exploited-attacks/
[5] https://community.citrix.com/techzone-blogs/netscaler/netscaler-global-deny-list-always-on-protection-for-the-threats-you-havent-modeled-yet-r1254/#2_Unconditional_evaluation_in_the_request_pipeline__3e5a90
[6] https://community.citrix.com/techzone-blogs/110_security-updates/security-update-guidance-for-netscaler-saml-authentication-deployments/
[7] https://www.cisa.gov/news-events/alerts/2026/10/04/cisa-adds-one-known-exploited-vulnerability-catalog
[8] https://x.com/watchtowrcyber/status/2106177591438958751
[9] https://www.esentire.com/security-advisories/citrix-netscaler-adc-and-netscaler-gateway-zero-day-vulnerabilities-cve-2026-88771-cve-2026-88772
[10] https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772