Citrix has released fixed builds for CVE-2026-88779, a memory-buffer vulnerability in customer-managed NetScaler ADC and NetScaler Gateway appliances, and says attackers have already targeted unpatched systems with it. Only on-premises appliances configured for SAML authentication, as either a service provider (SP) or an identity provider (IdP), with Gateway or AAA functionality enabled are exploitable. Citrix describes the bug as a denial-of-service issue. Researchers are still investigating whether it can also be used for remote code execution.

The Cybersecurity and Infrastructure Security Agency (CISA) added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on October 4, 2026, and gave Federal Civilian Executive Branch (FCEB) agencies until October 7 to mitigate it. That federal deadline has passed.

What Citrix has confirmed

"Citrix has observed targeted attacks on unmitigated NetScaler deployments which can lead to Denial of Service," Citrix said in a blog post on October 4. BleepingComputer reports that Citrix says the issue affects availability and that it has found no impact on the integrity of customer data. In the KEV catalog, CISA lists the flaw as "Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability." The NVD record was published on October 4.

The two published severity scores differ. Citrix, the CVE Numbering Authority, rates the flaw 8.7 under CVSS 4.0. NVD's own CVSS 3.1 assessment puts it at 7.5. Both score only availability impact.

Affected and fixed builds

NVD and Citrix's fix guidance list these builds as vulnerable:

  • NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.41
  • NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.28
  • NetScaler ADC 14.1 FIPS before 14.1-73.41 FIPS
  • NetScaler ADC 13.1 FIPS and NDcPP before 13.1-37.282

Some customers will have to patch twice in quick succession. Citrix's earlier bulletin covered CVE-2026-88771 through CVE-2026-88778, a batch of eight flaws that Help Net Security says included two exploited zero-days, CVE-2026-88771 and CVE-2026-88772. According to BleepingComputer, Citrix told customers who upgraded for that batch and whose deployments meet the SAML preconditions to "please upgrade your deployment again."

Crash, or compromise?

The first signs surfaced on Friday, October 2, before the advisory, when admins reported that appliances already patched for the earlier flaws were rebooting unexpectedly. BleepingComputer reports that one admin described multiple customers on 14.1-73.37 suffering repeated forced reboots, including appliances rebuilt from fresh images. A Reddit thread said the nsaaad process kept crashing until NetScaler's Pitboss watchdog hit its restart limit and rebooted the box. Citrix said in a security notice that same day that it was tracking a "newly observed issue" tied to SAML in customer-managed deployments, separate from the previously disclosed vulnerabilities.

Several reports point beyond a simple crash:

  • Attempted payload delivery. One admin on 14.1-73.37 found crafted authentication usernames containing shell commands intended to fetch and run a payload from 213.209.159[.]55, logged just before three nsaaad crash sequences. The admin stressed this showed attempted exploitation, not confirmed execution, BleepingComputer reports.
  • Malware on a honeypot. Security researcher Kevin Beaumont said his patched NetScaler 13.1 and 14.1 honeypots crashed after requests from multiple source IPs, and he later found one honeypot running a downloaded malware binary. He said that showed the activity went beyond denial of service, and said it was being "sprayed and prayed," BleepingComputer reports.
  • Webshell attempts. Help Net Security reports attackers appear to be trying to download and run a script that installs webshells.
  • A familiar pattern. Beaumont noted that Citrix's "Memory overflow vulnerability leading to Denial of Service" wording resembles how CVE-2025-6543 was first described before attackers used that bug for code execution.

watchTowr Labs has reproduced the vulnerability but has not published technical details, according to both outlets. Bishop Fox and watchTowr researchers are credited with flagging the flaw, Help Net Security reports.

Detection tooling and its limits

Citrix provides an indicator-of-compromise (IoC) script through NetScaler Console. watchTowr advised, as quoted by Help Net Security, that the latest script version can report suspicious "nobody" processes even where no compromise exists, so results need careful review, and that administrators should preserve evidence before applying the update. A Geico threat hunter has shared a SIGMA rule for spotting scanning and exploitation attempts, Help Net Security reports.

For organizations that cannot upgrade immediately, Citrix has released signatures for its Global Deny List that block known malicious IP addresses, but it still recommends installing the fixed builds as soon as possible.

What It Means for Defenders

  • Scope it by configuration. Inventory customer-managed ADC and Gateway appliances and identify those with a SAML SP or IdP configuration plus Gateway or AAA. Those are the exposed systems.
  • Preserve, then patch. Capture logs, running processes and a file listing from in-scope appliances before upgrading, then run the IoC script and manually triage any "nobody" process hits.
  • Don't trust a recent patch cycle. Builds that closed CVE-2026-88771 through -88778 are still vulnerable to this flaw. Treat Global Deny List signatures as a stopgap only.
  • Treat unexplained reboots as possible incidents. Review authentication logs for malformed usernames, block and hunt for 213.209.159[.]55, check web-accessible directories for unfamiliar files, and rotate credentials and SAML signing material on any appliance that shows signs of tampering.
  • FCEB agencies: any system still on a vulnerable build is past the KEV due date and needs remediation and a compromise check now.

Sources