Citrix released emergency security updates early Sunday for a zero-day vulnerability in NetScaler ADC and NetScaler Gateway that is being exploited in targeted attacks. Tracked as CVE-2026-88779 with a CVSS score of 8.7, the flaw forces an awkward repeat upgrade: administrators who patched just two weeks ago for the previous NetScaler zero-days have to do it all over again.
According to Citrix's security advisory, CVE-2026-88779 is a memory overflow vulnerability in NetScaler ADC and NetScaler Gateway. Exploitation requires a specific deployment condition: the appliance must be configured as a SAML service provider (SP) or SAML identity provider (IdP). Administrators can check by looking for `add authentication samlAction` or `add authentication samlIdPProfile` in the running configuration. Fixed builds are 14.1-73.41 and 13.1-64.28, plus corresponding FIPS releases, The Hacker News reported on October 5.
"Citrix has observed targeted attacks on unmitigated NetScaler deployments which can lead to Denial of Service," the company said in a blog post. "If the condition is triggered repeatedly, the service may remain unavailable. Our analysis indicates that this issue affects service availability, and we have not identified an impact on the integrity of customer data." Alongside the patches, Citrix is offering Global Deny Lists that block known malicious IP addresses — while still urging customers to install the updates as soon as possible.
The repeat upgrade is the painful part. BleepingComputer reports the attacks first surfaced on Thursday, when administrators noticed recently patched appliances rebooting unexpectedly — many already running build 14.1-73.37, the September 27 release that fixed CVE-2026-88771 and CVE-2026-88772. The symptom: repeated crashes of the `nsaaad` process, after which the Pitboss watchdog hit its restart limit and rebooted the appliance. Citrix first posted a notice about a "newly observed issue" tied to SAML configuration with no CVE and no fix; the identifier and patches arrived over the weekend. Citrix's guidance is explicit: customers who upgraded for CVE-2026-88771 through CVE-2026-88778 and meet the SAML preconditions should upgrade again.
The "availability only" framing is being challenged. Security researcher Kevin Beaumont said honeypots he runs downloaded and executed malware binaries even after patching: "So on one of the honeypots it's running a downloaded (malware) binary. Both were patched, so new vuln." That points to possible remote code execution, not just denial of service. Tenable's FAQ adds context: of September's zero-days, CVE-2026-88772 was being exploited no later than early September, according to Mandiant and Google's Threat Intelligence Group.
The US Cybersecurity and Infrastructure Security Agency has added CVE-2026-88779 to its Known Exploited Vulnerabilities catalog, ordering federal civilian agencies to remediate by October 7, 2026 — the strongest possible prioritization signal for private organizations too. Next steps for defenders are twofold: get SAML-configured appliances onto the newest builds fast, and — in the words of Undercode News — don't confuse "patched" with "not compromised." Mandiant advises checking for signs of intrusion and preserving evidence before patching, since a patch can't evict an attacker who is already in.