Citrix patches NetScaler flaw after targeted attacks

Citrix said it had issued updates for CVE-2026-88779 in NetScaler ADC and NetScaler Gateway after saying the flaw had been used in targeted attacks. It described the bug as a memory overflow that could trigger denial of service in some customer-managed deployments.

According to Citrix, exploitation required the software to be set up either as a SAML service provider or as a SAML identity provider. The company told customers to look for configuration entries tied to those SAML settings.

Citrix said the affected branches had been fixed in 14.1-73.41 and later, 13.1-64.28 and later, 14.1-FIPS 14.1-73.41 FIPS and later, and 13.1-FIPS and 13.1-NDcPP 13.1-37.282 and later. It said the issue affected availability and that it had not found an effect on customer data integrity.

Citrix said Bishop Fox and watchTowr had reported the flaw. watchTowr said on X that it reproduced the problem within hours of spotting honeypot activity, and CISA later added the CVE to its Known Exploited Vulnerabilities catalogue with an 7 October 2026 deadline for federal agencies.