The Cybersecurity and Infrastructure Security Agency has added CVE-2026-88779 to its Known Exploited Vulnerabilities catalog following reports of active attacks targeting Citrix NetScaler ADC and Gateway appliances. The memory overflow vulnerability allows attackers to trigger repeated denial-of-service conditions, causing impacted systems to crash and reboot.
Targeted Attacks and Exploitation Signals
Citrix reported observing targeted attacks against unmitigated on-premises deployments, noting that while the flaw affects service availability, the company has not identified an impact on customer data integrity. Researchers at Bishop Fox and watchTowr flagged the bug, with watchTowr confirming reproduction of the issue. System administrators on Reddit reported appliance crashes following recent patching routines for other zero-day vulnerabilities, while security researcher Kevin Beaumont observed automated attacks trying to run scripts to deploy webshells and malware binaries. A threat hunter at Geico also shared a SIGMA rule to help teams detect probing and exploitation attempts.
Affected Configurations and Remediation Options
The vulnerability impacts on-premises NetScaler appliances configured to use SAML authentication as either a service provider or identity provider in combination with Gateway or AAA functionality. Affected versions include NetScaler ADC and Gateway 14.1 prior to 14.1-73.41, 13.1 prior to 13.1-64.28, as well as specific FIPS and NDcPP builds prior to 14.1-73.41 FIPS and 13.1-37.282. Citrix recommends upgrading to updated builds and applying Global Deny List signatures to restrict access from malicious IP addresses while preparing patches.
Compromise Verification and Federal Mandates
Citrix has made an indicator of compromise script available through the NetScaler Console to assist administrators in scanning for intrusion. However, watchTowr noted that the tool may report false positives concerning suspicious processes, recommending careful verification and evidence preservation prior to patching. CISA has instructed US federal civilian agencies to remediate the flaw and inspect their networks for compromise by October 7.
AI-generated editorial illustration; not a documentary photograph.
Source: CISA flags new exploited NetScaler flaw as attackers crash appliances (CVE-2026-88779)
SIGNAL TITANS
Leave a Reply