Citrix NetScaler zero-day under active exploitation, CISA orders federal agencies to patch

New SAML-related denial-of-service flaw adds to a turbulent month for the networking appliance line

By LineZotpaper

Published6 October 2026

Read Time3 min

Citrix is racing to patch yet another NetScaler vulnerability, CVE-2026-88779, a memory overflow bug in SAML authentication that is already being exploited in the wild and can knock appliances offline. The US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed active exploitation and ordered federal agencies to apply fixes by Wednesday.

Citrix has released patches for a newly disclosed NetScaler vulnerability after reports of active attacks, and CISA has ordered federal agencies to remediate it within days.

The flaw, tracked as CVE-2026-88779, is a memory overflow bug that causes denial of service. It affects NetScaler ADC and Gateway appliances configured as a SAML service provider or identity provider, the setup used for single sign-on authentication.

Citrix said it was alerted to the issue late last week and confirmed it was investigating a "newly observed issue related to SAML authentication in customer-managed NetScaler deployments." By Saturday night the vendor had released a security advisory with patches, urging customers to "install the relevant updated versions as soon as possible."

"We were recently alerted to a new issue that affects service availability for some NetScaler deployments," a Citrix spokesperson said. "After we were alerted to this issue we immediately developed and published a mitigation while concurrently developing, testing and deploying a fix."

Security researchers at watchTowr, who reproduced the vulnerability and were credited by Citrix along with Bishop Fox for helping address it, said the bug is trivially easy to trigger. "This vulnerability is incredibly simple to trigger, with a single specially crafted request being all that is needed to knock an appliance offline," said Jake Knott, watchTowr's head of threat intelligence. "Exploitation is already occurring in the wild, and disrupting an authentication gateway can prevent legitimate users from accessing the services behind it."

watchTowr suspects the denial-of-service bug has been used to deliberately crash machines, making exploitation of an earlier NetScaler vulnerability, CVE-2026-88771, faster. That flaw is among eight CVEs Citrix disclosed on September 27, weeks after attackers began abusing two of them.

Knott noted that Citrix provides an indicator-of-compromise script for exposed appliances, though "a clean result is not definitive proof." He urged security teams to prioritize appliances configured as Gateway or AAA virtual servers with SAML enabled, and to apply the fixed build or Citrix's interim mitigation if an immediate upgrade is not possible.

Citrix did not answer questions about how many instances have been affected or what attackers are doing after exploiting the bug.

Analysis

Why This Matters

NetScaler appliances sit between users and critical applications, so a denial-of-service flaw can lock legitimate users out of every service behind the gateway.
The new bug follows eight disclosed CVEs, two of which were abused for weeks before patches arrived, showing persistent attacker interest in Citrix gear.
Federal agencies face a hard Wednesday patching deadline, and the same urgency applies to private sector operators running SAML-configured appliances.

Background

NetScaler ADC and Gateway are enterprise appliances widely used for load balancing, remote access and single sign-on. SAML is a common authentication protocol that lets users log in once and access multiple services. Over recent weeks Citrix has dealt with a wave of security issues, including a batch of vulnerabilities disclosed in late September, two of which were already being exploited. The new zero-day is technically separate from that batch, but researchers suspect it may be used to make one of the earlier flaws easier to exploit.

Key Perspectives

Citrix: Says it acted quickly after being alerted, developing a mitigation and a full fix, and is urging customers to apply updated builds as soon as possible. watchTowr and security researchers: Describe the flaw as extremely simple to trigger with a single crafted request, warn that exploitation is underway, and suggest the bug may be used to crash appliances to speed up exploitation of the earlier CVE-2026-88771. CISA and federal agencies: Have confirmed active exploitation and ordered agencies to patch by Wednesday, treating the issue as an urgent operational risk. Critics and skeptics: May question the pattern of disclosure, since two earlier bugs were abused before Citrix acknowledged them. Security teams also face uncertainty because a clean indicator-of-compromise scan is not definitive proof that an appliance is safe.

What to Watch

Whether federal agencies meet the Wednesday patch deadline and whether any breach disclosures follow.
Whether Citrix discloses how many NetScaler deployments were affected, a question it has not yet answered.
Whether researchers confirm the suspected link between the denial-of-service bug and faster exploitation of CVE-2026-88771.

Sources

Citrix NetScaler security snafus get even worse amid more 0-day reports — www.theregister.com - Articles