Citrix NetScaler: Three Exploited Zero-Days in Eight Days, and You May Need to Upgrade Twice

Upgrade NetScaler ADC and Gateway to 14.1-73.41 or 13.1-64.28 or later, even if you patched last week. CVE-2026-88779, a memory overflow in NetScaler configured as a SAML service provider or identity provider, was added to CISA's Known Exploited Vulnerabilities catalog on October 4 with a federal due date of today, October 7 (Help Net Security). The builds that fixed the September flaws do not fix this one.

NetScaler has had a hard year, and we covered CVE-2026-8452 earlier. The last eight days have been worse: three exploited vulnerabilities across two advisories, on appliances that sit at the edge of most organizations' remote access.

The September 27 pair

On September 27, Citrix disclosed CVE-2026-88771, an input validation flaw allowing unauthenticated remote code execution in default configurations, and CVE-2026-88772, a DTLS memory overflow. Both carry CVSSv4 scores of 9.5, and CISA added both to KEV the same day. Six other CVEs in the same bulletin, CVE-2026-88773 through 88778, were not reported as exploited (The Hacker News).

Rapid7 reported first exploitation attempts on September 20, a week before disclosure, and confirmed two compromised organizations (Rapid7). Fixed builds were 14.1-73.37 and 13.1-64.23.

The October 4 addition

CVE-2026-88779 (CVSS 8.7) is a memory overflow in NetScaler appliances configured as a SAML SP or IdP. Citrix confirmed exploitation causing denial of service, with the possibility of remote code execution under investigation (BleepingComputer). Help Net Security reported attackers crashing appliances and listed a payload-hosting IP address of 213.209.159[.]55 (Help Net Security).

Fixed builds per Citrix bulletin CTX697174:

• NetScaler ADC and Gateway 14.1-73.41 and later
• NetScaler ADC and Gateway 13.1-64.28 and later
• NetScaler ADC 14.1-73.41 FIPS and NDcPP
• NetScaler ADC 13.1-37.282 FIPS and NDcPP

These builds also include the September fixes. Anyone who stopped at 14.1-73.37 or 13.1-64.23 must upgrade again. Citrix also published Global Deny List signatures for cloud-connected appliances as a stopgap, but they do not replace the upgrade.

What to hunt for

• Unexpected appliance crashes or restarts since September 20, especially on SAML-enabled virtual servers. A crash may be an exploitation attempt, not a fault.
• Connections to or from 213.209.159[.]55 in firewall and proxy logs.
• New files, web shells, or modified scripts on the appliance, and new local accounts.
• Session hijacking indicators on Gateway: user sessions from unusual locations or concurrent sessions for the same user.

If you find anything, preserve the appliance's state before rebuilding, then terminate all active sessions and rotate credentials and certificates stored on the device. Treat it as an incident, because a compromised Gateway sits in front of your internal network.

Why the double upgrade matters

Patching an edge appliance once and closing the ticket is how organizations end up exposed to the second wave. When a product has an active run of exploited bugs, assume more are coming: subscribe to the vendor's bulletin feed, re-check the fixed version each time KEV updates, and keep a rebuild runbook ready. The same lesson showed up with SonicWall SMA1000 and PAN-OS GlobalProtect this year.

Cyberuptive's MDR team watches edge appliances for these patterns around the clock, and our patch management service tracks vendor fixed-version changes so a second upgrade does not get missed. Talk to us if you need help with the hunt.

Frequently asked questions

What is CVE-2026-88779?

A memory overflow vulnerability in Citrix NetScaler ADC and Gateway configured as a SAML service provider or identity provider. Exploitation causing denial of service is confirmed, and possible remote code execution is under investigation.

When was CVE-2026-88779 added to CISA KEV?

On October 4, 2026, with a federal civilian agency due date of October 7, 2026.

Which NetScaler builds fix CVE-2026-88779?

NetScaler ADC and Gateway 14.1-73.41 and 13.1-64.28 or later, NetScaler ADC 14.1-73.41 FIPS and NDcPP, and NetScaler ADC 13.1-37.282 FIPS and NDcPP.

If I patched for CVE-2026-88771 and 88772, am I protected?

No. Builds 14.1-73.37 and 13.1-64.23 fixed the September 27 flaws but not CVE-2026-88779. Upgrade to 14.1-73.41 or 13.1-64.28 or later.

When did exploitation of the NetScaler flaws begin?

Rapid7 observed first exploitation attempts against CVE-2026-88771 and CVE-2026-88772 on September 20, 2026, a week before Citrix disclosed them, and confirmed two compromised organizations.