Citrix rushes out fix for exploited NetScaler zero-day

Citrix has released emergency updates for its NetScaler appliances, patching CVE-2026-88779, a flaw already being used in zero-day attacks. The vendor classifies it as a denial-of-service vulnerability, but researchers are investigating whether it can also enable remote code execution.

What the flaw is

The issue is a memory buffer flaw affecting NetScaler ADC and NetScaler Gateway appliances that use SAML authentication with Gateway or AAA functionality. It carries a CVSS score of 8.7. Citrix says targeted attacks have hit unmitigated deployments, causing denial-of-service conditions: if the trigger is repeated, the service may stay unavailable. The company stresses that availability is affected but reports no impact on the integrity of customer data.

Early Sunday, Citrix shipped NetScaler ADC and Gateway 14.1-73.41 and 13.1-64.28. FIPS deployments should move to 14.1-73.41 FIPS, while FIPS and NDcPP customers on the 13.1 branch should install 13.1-37.282. Global Deny Lists for known malicious IPs are also available, but Citrix calls installing the updates the priority.

An irritating detail: organizations that recently upgraded to fix CVE-2026-88771 through 88778 must upgrade again if their configuration uses SAML.

Suspicions of code execution

Though Citrix calls this a denial-of-service issue, administrators and researchers have seen activity pointing to remote code execution. The first reports came Thursday, when freshly patched appliances began rebooting unexpectedly. On Reddit, admins described repeated forced reboots on version 14.1-73.37, including on devices rebuilt from clean images. The nsaaad process kept crashing until the Pitboss service hit its restart limit.

One administrator found authentication usernames in the logs containing shell commands that downloaded a payload from 213.209.159[.]55, saved it as /v, and executed it. Those requests preceded nsaaad crashes, though successful execution was not confirmed.

Security researcher Kevin Beaumont reported that his patched honeypots on 13.1 and 14.1 were crashing after requests from multiple IPs, and that one of them ended up running a downloaded malware binary — despite not even having a valid SSL certificate. He called the campaign "spray and pray" and noted that CVE-2025-6543 was likewise first described as denial-of-service before proving to allow code execution. watchTowr Labs also confirmed it reproduced the flaw, without disclosing technical details.

On Sunday, CISA added CVE-2026-88779 to its Known Exploited Vulnerabilities catalog, confirming active exploitation and ordering federal agencies to mitigate by October 7.

Source: Bleeping Computer