Citrix has released emergency updates for a new NetScaler denial of service vulnerability known as CVE-2026-88779, which has been exploited in zero-day attacks. Researchers are investigating whether it can also be exploited for remote code execution.
The vulnerability is a memory buffer flaw that affects NetScaler ADC and NetScaler Gateway appliances that use SAML authentication with Gateway or AAA functionality.
The Citrix security advisory According to the statement, the vulnerability has a CVSS score of 8.7 and was used to target attacks on unrestricted NetScaler deployments, resulting in denial of service conditions.
“Citrix has observed targeted attacks on unconstrained NetScaler deployments that can result in denial of service.” Citrix said in a related blog post published today.
“If the condition is triggered repeatedly, the service may remain unavailable. Our analysis shows that this issue impacts service availability and we have not observed any impact on the integrity of customer data.”
Early Sunday morning, Citrix released NetScaler ADC and NetScaler Gateway 14.1-73.41 and 13.1-64.28 to fix the zero-day bug CVE-2026-88779.
For FIPS deployments, customers should upgrade to 14.1-73.41 FIPS. NetScaler ADC FIPS and NDcPP customers on the 13.1 branch should install 13.1-37.282.
Citrix also provides global deny lists that block access from known malicious IP addresses. However, the company recommends customers install the newly released security updates as soon as possible.
The company says that organizations can determine whether their devices are vulnerable to the flaw by checking whether SAML authentication is configured:
- The appliance is configured as SAML SP
add authentication samlActionOR
- The appliance is configured as a SAML IdP
add authentication samlIdPProfile
Unfortunately, organizations that recently updated NetScaler devices to address two actively exploited vulnerabilities will need to update them again to resolve this flaw.
“If you have updated your NetScaler deployment with one of the updated software versions listed in the security bulletin for CVE 2026-88771 through CVE 2026-88778, and if you have determined that your NetScaler deployment meets the prerequisites described above, please update your deployment again,” Citrix warned.
Researchers investigate possible code execution
While Citrix describes CVE-2026-88779 as a denial of service vulnerability, NetScaler administrators and cybersecurity researchers have noticed activity that suggests the vulnerability can be exploited for remote code execution.
The new attacks were first reported Thursday after NetScaler administrators reported that recently patched appliances were unexpectedly restarting.
In one Reddit threadAccording to a NetScaler administrator, several customers running NetScaler 14.1-73.37 experienced repeated forced reboots despite having installed the latest security updates available at the time.
Other administrators quickly reported similar behavior, including with appliances rebuilt from new images. Another Reddit thread said nsaaad crashed repeatedly until NetScaler’s Pitboss process reached its restart limit and restarted the appliance.
It was initially unclear whether vulnerability scanners triggered a flaw in the recently released firmware or whether attackers were actively exploiting new vulnerabilities in NetScaler devices.
However, an administrator investigating these incidents on NetScaler 14.1-73.37 devices saw crafted authentication usernames with shell commands that download a payload from the IP address 213.209.159(.)55, save it as /v, and execute the file.
According to the administrator, these requests appeared immediately before three confirmed NSAAAD crash sequences on an appliance and targeted multiple SAML authentication factors.
The administrator emphasized that the logs showed attempted exploitation and associated crashes, but did not confirm that the commands were executed successfully.
Other administrators reported the same crash patterns from nsaaad and Pitboss, even on systems already updated to version 14.1-73.37.
While administrators continued to investigate the crashes, Citrix released a Safety notice announced Friday that its engineering and support teams are tracking a “newly observed issue” related to SAML authentication in customer-managed NetScaler deployments.
The company stated that affected configurations included either a authentication samlAction or authentication samlIdPProfile Fixed setting and advised customers experiencing the issue to contact Citrix Support.
Citrix also confirmed that the issue was different from previously disclosed NetScaler vulnerabilities.
Cybersecurity expert Kevin Beaumont also reported that patched NetScaler 13.1 and 14.1 honeypots crashed after receiving requests from multiple source IP addresses, describing the activity as potentially another “PitScaler” vulnerability.
He later said the activity appeared to go beyond a mere denial of service after he discovered that one of his patched honeypots was executing a downloaded malware payload.
“So one of the honeypots is running a downloaded (malware) binary. Both have been patched, so a new vulnerability,” Beaumont said.
“It’s spraying and praying. One of the honeypots doesn’t even have a valid SSL certificate because I let it expire.”
Beaumont also said that CVE-2026-88779 was described as a “memory overflow vulnerability leading to denial of service,” similar to how the previously disclosed CVE-2025-6543 was initially characterized before later attacks showed that it could be used for remote code execution.
Cybersecurity company watchTowr Labs also confirmed that it reproduced the vulnerability after first investigating reports of NetScaler honeypot activity.
The researchers have not yet disclosed technical details about how they reproduced the error.
On Sunday, CISA added CVE-2026-88779 to its catalog of known exploited vulnerabilities. This confirms that the vulnerability is being actively exploited and gives FCEB agencies until October 7 to fix the vulnerability.
