critical4 sourcesCVE-2025-6543 CVE-2026-88771 +2
Citrix has rolled out emergency security updates to address an actively exploited zero-day flaw affecting NetScaler ADC and NetScaler Gateway appliances, tracked as CVE-2026-88779 with a CVSS v4 score of 8.7.
The vulnerability is classified as a memory buffer overflow (CWE-119) that impacts appliances configured either as a SAML Service Provider via `add authentication samlAction` or as a SAML Identity Provider using `add authentication samlIdPProfile`.
Administrators first raised alarms over the weekend after observing appliances running recently patched firmware versions—such as NetScaler 14.1-73.37—continuously rebooting due to the `nsaaad` authentication daemon crashing until the internal `Pitboss` process hit its watchdog restart threshold.
While Citrix officially characterizes the vulnerability strictly as a denial-of-service issue with no observed data integrity impact, incident handlers and external researchers observed weaponized exploitation attempts passing crafted usernames containing shell commands designed to stage second-stage payloads such as `/v` from remote infrastructure.
Independent testing yielded mixed assessments: security firm watchTowr reproduced the flaw as a DoS mechanism that can trigger rapid reboots—possibly chained to accelerate exploitation of previously disclosed vulnerabilities like CVE-2026-88771—while other security researchers observed compromised honeypots executing staged binaries.
To remediate the vulnerability, Citrix published patched firmware builds across supported lines, including versions 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, and 13.1-37.282 NDcPP.
The vendor has also supplied Global Deny Lists intended to temporarily block known attacking IP addresses, though standard patch application remains mandatory.
Due to confirmed active exploitation in the wild, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-88779 to its Known Exploited Vulnerabilities catalog, ordering US civilian federal agencies to apply patches by October 7.
Read more → about Citrix NetScaler Under Active Attack via SAML Zero-Day CVE-2026-88779critical6 sourcesCVE-2025-7775 CVE-2026-19490 +12
Citrix has released emergency security updates addressing eight vulnerabilities across customer-managed NetScaler ADC and NetScaler Gateway deployments, including two critical zero-day flaws tracked as CVE-2026-88771 and CVE-2026-88772. The patches arrived shortly after national cyber authorities, including the Dutch NCSC-NL and Australia's ACSC, began privately notifying administrators and advising them to shut down internet-facing NetScaler appliances immediately.
Both zero-day vulnerabilities enable unauthenticated threat actors to achieve remote code execution on target devices, sporting CVSS 4.0 scores of 9.5. Specifically, CVE-2026-88771 stems from improper input validation and affects all default configurations across NetScaler ADC and Gateway appliances without requiring special feature flags. The companion flaw, CVE-2026-88772, is a memory overflow vulnerability affecting systems where Datagram Transport Layer Security (DTLS) is enabled, which is configured on by default across VPN virtual servers.
The broader advisory also mitigates six additional flaws, ranging from HTTP request smuggling in CVE-2026-88773 (CVSS 9.3) to memory overflows and TCP initial sequence number prediction issues. In response to confirmed active exploitation, CISA updated its Known Exploited Vulnerabilities catalog and mandated that US federal agencies patch all vulnerable appliances under Binding Operational Directive 26-04 by September 30.
Remediation builds include NetScaler 14.1-73.37, 13.1-64.23, and corresponding updated FIPS and NDcPP packages, while unsupported releases such as versions 12.1 and 13.0 require immediate platform migration. Threat monitoring from Shadowserver currently detects over 23,000 reachable NetScaler IP addresses across the internet, underlining a massive attack surface for edge infrastructure. Citrix has published basic indicators of compromise through NetScaler Console, while simultaneously cautioning operators that these telemetry artifacts might be insufficient to identify sophisticated breaches.
Read more → about Citrix Patches Dual NetScaler Zero-Days Under Active Exploitation Following Emergency Shutdown Advisoriescritical3 sourcesCVE-2015-3246 CVE-2015-5287 +5
On August 26, 2026, CISA expanded its Known Exploited Vulnerabilities catalog with six additions across enterprise technologies. A prominent entry is CVE-2026-8452, a memory overflow issue affecting NetScaler ADC and Gateway appliances configured for AAA virtual servers or VPN gateways. While Citrix initially described the vulnerability as causing unpredictable behavior or denial-of-service, security researchers at WatchTowr published a proof-of-concept demonstrating unauthenticated remote code execution. Threat telemetry firms Previdian and Defused subsequently reported in-the-wild exploitation involving web shell deployments and discovery commands like `id` and `echo`. Fixed firmware releases include versions `14.1-72.61`, `13.1-63.18`, and `13.1-37.272`. Alongside the NetScaler flaw, CISA flagged CVE-2019-1068, a remote code execution bug in Microsoft SQL Server triggered via crafted queries. This flaw enables attackers to execute arbitrary code within the database engine's service account context. The catalog additions also encompass legacy vulnerabilities including Red Hat `libuser` race conditions (CVE-2015-3246), Red Hat ABRT privilege escalation (CVE-2015-5287), Ajax.NET Professional deserialization (CVE-2021-23758), and a Linux kernel out-of-bounds write flaw (CVE-2022-0995). CISA established an August 29 remediation deadline for the Citrix and Microsoft SQL vulnerabilities for affected federal entities, with remaining flaws slated for mitigation by September 9. Historical context notes this follows rapid exploitation of another NetScaler flaw, CVE-2026-8451, earlier in the year.
Read more → about CISA Updates KEV Catalog as Threat Actors Target Citrix NetScaler and Legacy Enterprise Software