New Net Scaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline
Summary: Citrix released security updates for CVE-2026-88779, a memory overflow vulnerability with a CVSS score of 8.7 in NetScaler ADC and NetScaler Gateway that has been exploited in targeted zero-day attacks. Exploitation requires the appliance to be configured as a SAML service provider or identity provider, and Citrix said repeated triggering can cause a denial-of-service that leaves the service unavailable, with no identified impact on customer data integrity.
What's compelling: CISA added CVE-2026-88779 to its KEV catalog and requires federal agencies to patch by October 7, 2026, and watchTowr reproduced the flaw within hours of detecting NetScaler honeypot activity - so the window between disclosure and working exploitation is already closed.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-88771CVE-2026-88772CVE-2026-88779
- Related
- Citrix Net Scaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation Cyber Risks · Sep 28, 2026