Citrix NetScaler security snafus get even worse amid more 0-day reports

Citrix NetScaler appliances are facing a barrage of attacks, with new vulnerabilities being discovered and exploited by malicious actors. The latest issue, identified as CVE-2026-88779, is a memory overflow bug that can lead to denial of service attacks. This flaw only affects NetScaler ADC and Gateway appliances that are configured as SAML service providers or identity providers, which are commonly used for single sign-on authentication.

Citrix confirmed on Friday that it is investigating a newly observed issue related to SAML authentication in customer-managed NetScaler deployments. The vendor released a security advisory with patches on Saturday, urging vulnerable customers to install the updated versions as soon as possible. WatchTowr researchers suspect that the new vulnerability is being used to crash machines and potentially accelerate the exploitation of two earlier Citrix security holes (CVE-2026-88772 and CVE-2026-88771).

Citrix has not provided specific details about the number of affected instances or the attackers' actions after exploiting the bug. However, they strongly encouraged customers to apply the fix to their NetScaler instances quickly. The US Cybersecurity and Infrastructure Security Agency (CISA) also confirmed that CVE-2026-88779 is under active exploitation and advised federal agencies to patch the bug by Wednesday.

Security experts emphasize the ease with which this vulnerability can be triggered, requiring only a single specially crafted request to render an appliance offline. WatchTowr's head of threat intelligence, Jake Knott, stressed that exploiting this authentication gateway can prevent legitimate users from accessing services. Citrix provided an indicator-of-compromise script for security teams to check exposed appliances for signs of compromise.