Cybersecurity
Citrix patches exploited NetScaler SAML flaw
Citrix released emergency updates for CVE-2026-88779 after targeted attacks on NetScaler appliances using SAML authentication, while administrators and researchers examined whether the flaw could also enable code execution.
- Citrix said CVE-2026-88779 affected NetScaler ADC and NetScaler Gateway appliances when SAML authentication was configured.
- The company said it had seen targeted attacks on unmitigated deployments and said the issue affected service availability rather than customer-data integrity.
- Citrix released 14.1-73.41 and 13.1-64.28 for the standard branches, plus 14.1-73.41 FIPS and 13.1-37.282 for FIPS and NDcPP customers.
- Administrators reported repeated reboots on patched appliances, and one said crafted usernames appeared to fetch and execute a payload from 213.209.159[.]55, though they did not confirm execution.
- CISA added CVE-2026-88779 to its Known Exploited Vulnerabilities catalogue and gave FCEB agencies until 7 October to mitigate it.
Citrix released emergency updates for CVE-2026-88779, a memory-buffer flaw in NetScaler ADC and NetScaler Gateway appliances when SAML authentication was configured. It said the flaw had been used against unmitigated deployments and that the effect it had observed was denial of service.
The company shipped 14.1-73.41 and 13.1-64.28 for the regular branches, and 14.1-73.41 FIPS plus 13.1-37.282 for FIPS and NDcPP deployments. It also published Global Deny Lists, while telling customers to install the software updates rather than depend on blocking known source addresses.
Reports of patched appliances rebooting followed on Thursday. One administrator said log entries showed crafted usernames that appeared to issue shell commands to retrieve a file from 213.209.159[.]55 and save it as /v, but the administrator did not prove the commands ran.
Citrix later said its teams were tracking a newly observed SAML-related issue and that it was separate from the earlier NetScaler vulnerabilities. Kevin Beaumont said one patched honeypot ran a downloaded binary, watchTowr Labs said it reproduced the flaw, and CISA then added CVE-2026-88779 to its Known Exploited Vulnerabilities catalogue with a 7 October deadline.
Named in this story
People
- Kevin Beaumont
- reported patched honeypots crashing and later seeing a downloaded payload
Companies
- Citrix
- released the emergency fixes and described the attacks
- watchTowr Labs
- said it reproduced the flaw after investigating the reports
Governments and agencies
- Cybersecurity and Infrastructure Security Agency
- added the flaw to its Known Exploited Vulnerabilities catalogue and set a 7 October deadline
Products and systems
- NetScaler ADC
- the appliance line affected by the flaw
- NetScaler Gateway
- the appliance line affected by the flaw
- CVE-2026-88779
- the memory-buffer flaw Citrix tracked as the zero-day
How the source tells it
The article read like a technical bulletin, but its register was urgent and provisional because it centred on emergency patching and an unresolved question about possible code execution.
- urgency emergency patching and mitigation deadlines framed the response
- uncertainty the piece repeatedly qualified whether the crashes meant denial of service or something more