What Happened

Citrix released emergency updates for CVE-2026-88779, a denial-of-service vulnerability in NetScaler ADC and Gateway appliances. The flaw, a memory buffer issue, is actively exploited in the wild when appliances are configured for SAML authentication. Citrix reported targeted attacks causing DoS conditions on unmitigated deployments. The CVSS score is 8.7, indicating high risk.

Who Is Affected

Affected versions include NetScaler ADC and Gateway 14.1 before 14.1-73.41 and 13.1 before 13.1-64.28. Organizations using these versions with SAML authentication are at immediate risk. Citrix has provided Global Deny Lists to block known malicious IP addresses and urges immediate patching.

Market Impact

• Security teams face urgent patching pressure this week due to active exploitation and high CVSS score.
• Some administrators report unexpected appliance reboots, raising concerns about potential remote code execution beyond DoS.
• Patch management, vulnerability scanning, and incident response vendors have a clear trigger to engage Citrix customers now.

What to Watch

Monitor for further exploitation attempts and any updates from Citrix regarding potential RCE capabilities. Security teams should verify patch deployment and review Global Deny Lists. The incident timeline and threat graph are available for tracking via Citrix and CVE-2026-88779 feeds.

Related coverage

• Citrix NetScaler Unpatched Pre-Auth RCE CVE-2026-88771 Actively Exploited
• CISA Confirms Critical Zero-Day Exploits in Citrix NetScaler ADC and Gateway
• Active Exploitation of Citrix NetScaler Zero-Day RCE Vulnerabilities
• GitLab Issues Urgent Patch for Critical AI Gateway RCE Flaw (CVE-2026-90970, CVSS 9.9)