Citrix NetScaler Zero-Day CVE-2026-88779 Exploited in Targeted Attacks

Citrix NetScaler Zero-Day CVE-2026-88779 Exploited in Targeted Attacks #

Citrix has released emergency security updates for a newly disclosed NetScaler vulnerability after confirming that attackers are exploiting the flaw in targeted attacks.

Tracked as CVE-2026-88779, the vulnerability affects customer-managed Citrix NetScaler ADC and NetScaler Gateway deployments under specific SAML configurations. Successful exploitation can cause a denial-of-service condition, potentially disrupting services that depend on the affected appliances.

What is CVE-2026-88779? #

CVE-2026-88779 is a memory overflow vulnerability in Citrix NetScaler ADC and NetScaler Gateway.

Citrix has assigned the vulnerability a CVSS 4.0 score of 8.7, classifying it as a high-severity security issue.

The vulnerability is not present in every NetScaler deployment. According to Citrix, the affected appliance must be configured to operate as either a SAML Service Provider (SAML SP) or a SAML Identity Provider (SAML IdP).

Citrix has confirmed that targeted attacks have been observed against unmitigated deployments.

Attackers Are Already Exploiting the Vulnerability #

The biggest concern for security teams is that CVE-2026-88779 is being exploited in real-world attacks rather than remaining a theoretical vulnerability.

Citrix reported targeted attacks against unmitigated NetScaler deployments that can result in denial-of-service conditions.

If the condition is triggered repeatedly, the affected service may remain unavailable.

Security researchers are also investigating whether the vulnerability could have additional exploitation possibilities. However, Citrix's current advisory describes the confirmed impact as denial of service, so organizations should not assume that remote code execution has been confirmed for this particular CVE.

Who Is Affected? #

The vulnerability affects customer-managed versions of:

• Citrix NetScaler ADC
• Citrix NetScaler Gateway

The affected supported releases include:

• NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.41
• NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.28
• NetScaler ADC 14.1-FIPS before 14.1-73.41 FIPS
• NetScaler ADC 13.1-FIPS and 13.1-NDcPP before 13.1-37.282

Citrix-managed cloud services are handled separately by Cloud Software Group.

How to Check Whether a NetScaler Deployment Is Affected #

Organizations can inspect their NetScaler configuration to determine whether the appliance meets the vulnerability's SAML preconditions.

A deployment configured as a SAML Service Provider may contain:

add authentication samlAction

A deployment configured as a SAML Identity Provider may contain:

add authentication samlIdPProfile

Organizations that find these configurations should treat the vulnerability as a priority and upgrade to a fixed release.

What Security Teams Should Do #

Organizations using affected NetScaler appliances should take the following steps:

1. Identify all customer-managed NetScaler ADC and NetScaler Gateway appliances.
2. Check the installed NetScaler version.
3. Determine whether SAML Service Provider or SAML Identity Provider functionality is configured.
4. Upgrade affected systems to a Citrix-recommended fixed release.
5. Review logs and security monitoring data for unusual activity involving NetScaler appliances.
6. Investigate unexpected service interruptions, reboots or other suspicious behavior.
7. Continue monitoring for additional NetScaler security advisories.

Citrix strongly recommends that affected customers install the relevant security updates as soon as possible.

Fixed Versions #

Citrix has released the following fixed versions:

Organizations should consult the official Citrix advisory before upgrading production systems and follow their normal change-management procedures.

Why This Matters #

NetScaler appliances are commonly deployed at the edge of enterprise networks and can provide application delivery, remote access and authentication services.

A successful denial-of-service attack against these systems can therefore affect the availability of business applications and remote access services.

The vulnerability is also significant because it follows several other recently disclosed NetScaler vulnerabilities, including vulnerabilities that Citrix previously confirmed were being exploited.

This latest incident highlights the importance of treating Internet-facing network appliances as critical security assets and applying emergency security updates when active exploitation is confirmed.

What Organizations Should Remember #

CVE-2026-88779 is a high-severity NetScaler vulnerability that is already being exploited in targeted attacks.

Organizations running affected customer-managed NetScaler ADC or NetScaler Gateway deployments should verify their configuration and software version and apply the appropriate Citrix security update as soon as possible.

Security teams should also monitor their NetScaler infrastructure closely for unusual activity and remain alert for additional security advisories affecting the platform.

Official Security Advisory #

Citrix has published the official security bulletin for CVE-2026-88779, including affected versions, configuration requirements and recommended fixes.

Security teams should use the official Citrix advisory as the primary source when planning remediation.