New Citrix NetScaler SAML Flaw CVE-2026-88779 Exploited in Zero-Day Attacks
Citrix released emergency patches for CVE-2026-88779, a high-severity memory buffer flaw in NetScaler ADC and Gateway appliances using SAML authentication. The vulnerability, which carries a CVSS score of 8.7, is being actively exploited in targeted attacks to cause denial-of-service conditions. While Citrix characterizes the issue as a service availability risk, researchers and administrators report evidence of remote code execution attempts, including malware payloads on patched systems. CISA has added the flaw to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by October 7, 2026. This latest incident follows a wave of exploitation of earlier NetScaler vulnerabilities in September 2026, affecting dozens of organizations across government, healthcare, and finance sectors.