Citrix has released emergency security updates to address a new vulnerability in NetScaler appliances that is being actively exploited in targeted attacks. The flaw, identified as CVE-2026-88779, affects NetScaler ADC and NetScaler Gateway devices configured with SAML authentication and has a severity rating of 8.7. The vulnerability is a memory buffer issue that causes denial-of-service conditions when triggered, potentially rendering services unavailable if attacks are repeated. Citrix has released patched versions for affected systems and provided Global Deny Lists to block known malicious IP addresses, but strongly recommends customers install the security updates immediately.
Security researchers are investigating whether the vulnerability can be used for remote code execution beyond the denial-of-service impact Citrix initially described. After administrators reported unexpected device reboots following patches, investigators discovered crafted authentication requests containing shell commands that appeared designed to download and execute malicious payloads. While the logs showed evidence of attempted exploitation and correlated system crashes, successful execution has not been confirmed. The U.S. Cybersecurity and Infrastructure Security Agency has confirmed the flaw is being actively exploited and set an October 7 deadline for federal agencies to mitigate the vulnerability.
Source: Read the full story at BleepingComputer
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
