errors.x7.al › Recent issues

Citrix discloses a third actively exploited NetScaler zero-day

Citrix has disclosed another actively exploited zero-day in its NetScaler ADC and NetScaler Gateway products, tracked as CVE-2026-88779, according to CyberScoop. This is the third publicly exploited NetScaler zero-day in roughly two weeks, following a pair disclosed days earlier. Citrix has published fixes and mitigation guidance, and the US cyber agency has flagged the flaw as exploited in the wild.

What's happening

According to CyberScoop, CVE-2026-88779 is considered less severe than the previous two flaws because exploitation triggers a denial of service and only affects instances that have SAML (Security Assertion Markup Language) authentication enabled. "This means it doesn't work out of the box against every NetScaler deployment," Jake Knott, head of threat intelligence at watchTowr, told CyberScoop. Still, he noted it is "incredibly simple to trigger, with a single specially crafted request being all that is needed to knock an appliance offline."

Citrix reportedly alerted customers on Friday and followed up with a detailed blog post and a security advisory (CTX697174) containing a patch. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog. Citrix declined to say how many customers are affected or when exploitation first occurred, though Knott said it likely began on Friday. CyberScoop notes that attempts against this flaw "clearly contain shellcode," which researchers say implies the attacker believes it can be used, or chained, to achieve remote code execution.

The earlier pair — CVE-2026-88771, a remote code execution flaw linked to improper input validation, and CVE-2026-88772, a memory overflow — were both confirmed under exploitation and rated 9.5 out of 10 for severity, per Cybersecurity Dive. That outlet reports a broader campaign: Google Threat Intelligence Group and Mandiant identified dozens of affected organizations across North America and Europe, and Arctic Wolf said at least 78 organizations were targeted, in what researchers believe is state-linked activity.

Who's affected

Organisations running internet-facing Citrix NetScaler ADC or NetScaler Gateway are the primary concern. For CVE-2026-88779, the impact is limited to deployments with SAML authentication enabled. Cybersecurity Dive reports that more than 20,000 NetScaler instances are exposed and potentially vulnerable, according to Shadowserver Foundation data, and that the affected sectors include government, healthcare, financial services, telecommunications, education, energy, media, and legal and professional services.

The fallout has been tangible in some places. The Dutch national cyber centre and Z-CERT warned critical infrastructure and healthcare providers, and some Dutch hospitals, including Frisius MC and Amphia, reportedly suspended online patient-portal access after taking NetScaler-based systems offline. Researchers also found custom tooling in the campaign, such as a PHP webshell called Whipshot and a Python tunneler called Slapshot.

What to do

• Apply Citrix's security upgrades: NetScaler ADC and Gateway 14.1-73.37 and later, 13.1-64.23 and later, 14.1-FIPS 14.1-73.37 and later, and 13.1-FIPS / 13.1-NDcPP 13.1.37.279 and later.
• If patching is not immediately possible, reduce exposure: temporary steps include disabling DTLS on internet-facing NetScaler Gateway servers and blocking inbound UDP/443 traffic to affected servers, per Cybersecurity Dive.
• Remember that upgrading alone may not remove post-exploitation access or stolen credentials; rotate credentials, revoke active sessions, audit downstream Citrix infrastructure (StoreFront servers, Delivery Controllers), and review Windows Event Logs for unusual logins or unexpected RDP use.
• For a suspected compromise, GTIG recommends isolating NetScaler from the wider network, while noting this can cause significant business disruption.
• Check CISA's Known Exploited Vulnerabilities catalog and Citrix's advisory for the latest guidance.

Sources

• CyberScoop — reports the third exploited zero-day (CVE-2026-88779), its denial-of-service impact, the SAML condition, and CISA's KEV listing.
• Cybersecurity Dive — details the earlier CVE-2026-88771 and CVE-2026-88772 flaws, the affected versions, exposed instance counts, and mitigation guidance.
• Citrix — the vendor security advisory for CVE-2026-88779 containing remediation guidance.