Third NetScaler zero-day hits SAML appliances already patched against the first two
Citrix confirmed CVE-2026-88779, a third exploited NetScaler zero-day, after appliances patched against the previous two began rebooting under attack. The vendor rates it denial of service, though logged payloads and a researcher's honeypot point toward code execution.
The Watch · Security desk
What happened
- Citrix says the flaw is a high-severity memory overflow in NetScaler ADC and Gateway instances set up as a SAML service provider or identity provider.
- Logs reviewed by affected admins showed authentication requests with shell commands hidden in the username field, written to fetch and run a malicious script.
- Researcher Kevin Beaumont, who named the bug PitScaler 2, reported that one of his honeypots was running a downloaded malware binary.
- A Reddit user who got hold of the script said it attempts to install web shells, persist across restarts and send the appliance's configuration and backups off the box, but warned there was no proof it had run.
Why it matters
- Who's exposed exposure Any ADC or Gateway in a SAML provider role was open to this attack whatever its patch level against the earlier pair, so the previous update cycle left SAML deployments exposed.
- What doesn't add up contradiction Citrix's availability-only rating and the field evidence of code-execution attempts lead responders to different scopes: an outage ticket under one, a compromise investigation under the other.
- Who has to decide decision Installing the fix does not settle whether a rebooted appliance ran the attackers' script, so owners have to assess each box that went down under attack in addition to updating it.
Next story · Security · Oct 9
SAML role decides which NetScaler appliances Citrix's new RCE flaw can reachConfirmed5 publishers
Citrix's public account of the flaw covers availability only. "Citrix has observed targeted attacks on unmitigated NetScaler deployments which can lead to Denial of Service," the company wrote in a blog post [3]. "If the condition is triggered repeatedly, the service may remain unavailable." [13] On customer data, it wrote: "Our analysis indicates that this issue affects service availability, and we have not identified an impact on the integrity of customer data." [4]
The payloads point further. Attackers who hide a download-and-run command in a login field [10] are trying for code execution, whatever rating the bug carries. SecurityWeek reported some indication that the flaw may be exploitable for remote code execution [18]. Beaumont saw exploitation attempts against honeypots that were already patched [7].
The sources differ in weight. Citrix's statement and CISA's catalog entry are on the record [3] [6]. The honeypot findings come from a named researcher [7] [8]. Everything known about what the script does traces to one Reddit user [11].
On exploitability: Citrix confirmed exploitation in the wild [2]. The trigger travels in authentication requests [10], and only appliances acting as a SAML service provider or identity provider are in scope [1]. Citrix confirms denial of service [3]. Code execution has been attempted, and the evidence that it can succeed comes from outside Citrix [18] [8].
The earlier pair, CVE-2026-88771 and CVE-2026-88772, had already pushed some customers to take appliances offline [5]. Updating against them did not help here: Reddit users said boxes already on the latest release kept rebooting [9]. Before fixes for the new bug arrived, admins described support queues lasting hours and interim workarounds that sometimes failed to stop the crashes [15].
CVE-2026-88779 is the sixth exploited NetScaler vulnerability CISA has added to its catalog in 2026 [12]. Three NetScaler zero-days have now surfaced within days of each other [17]. SecurityWeek's report does not name an actor behind the attacks [14], so on the public record the three are linked only by product and timing. Federal agencies got three days from listing to deadline [16].
What to watch
- Whether Citrix revises its advisory to acknowledge code execution, given Beaumont's report of a honeypot running downloaded malware.
- Forensic confirmation that the fetched script ran on any production appliance, including evidence of configuration or backup uploads.
- A seventh NetScaler entry in CISA's catalog this year, or public attribution tying CVE-2026-88771, -88772 and -88779 to one group.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+20
- Incentives50
- Confidence70
Perspective Coverage
11 publishers- Builder
- Builder 19%
- Operator
- Operator 68%
- Investor
- Investor 13%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
According to Citrix, CVE-2026-88779, classified as high severity, is a memory overflow issue affecting NetScaler ADC and NetScaler Gateway instances configured as a SAML SP or SAML IdP.
- [2]
Administrators initially reported reboots of fully patched NetScaler systems on Friday, and Citrix soon confirmed the existence of another zero-day exploited in the wild.
- [3]
"Citrix has observed targeted attacks on unmitigated NetScaler deployments which can lead to Denial of Service,"
- [4]
"Our analysis indicates that this issue affects service availability, and we have not identified an impact on the integrity of customer data."
- [5]
The attacks were spotted days after NetScaler administrators were warned about two actively exploited zero-days, CVE-2026-88771 and CVE-2026-88772, which forced some customers to pull the plug.
- [6]
CISA added CVE-2026-88779 to its KEV catalog on October 4, instructing federal agencies to address it by October 7.
- [7]
Security researcher Kevin Beaumont, who dubbed the vulnerability PitScaler 2, confirmed seeing exploitation attempts against patched honeypot instances.
- [8]
Kevin Beaumont reported that one of his honeypots was running a downloaded malware binary.
- [9]
Reddit users reported that NetScaler appliances already updated to the latest version in response to the CVE-2026-88771 and CVE-2026-88772 attacks kept rebooting.
- [10]
Logs reviewed by affected admins showed authentication requests carrying shell commands hidden in the username field and meant to fetch and run a malicious script.
- [11]
One user who obtained the script said it tries to plant web shells, survive reboots, and upload the appliance's configuration and backups, but cautioned that there was no proof the script actually ran.
- [12]
CVE-2026-88779 is the sixth exploited NetScaler vulnerability CISA added to its KEV catalog in 2026.
- [13]
"If the condition is triggered repeatedly, the service may remain unavailable."
- [14]
SecurityWeek's report on CVE-2026-88779 does not attribute the attacks to a named threat actor.
- [15]
Before patches arrived, admins complained about support queues that lasted hours and about interim workarounds that sometimes failed to stop the crashes.
- [16]
Federal agencies had three days between CVE-2026-88779's KEV listing and the remediation deadline.
- [17]
Three NetScaler zero-days (CVE-2026-88771, CVE-2026-88772, CVE-2026-88779) were exploited within days of each other.
- [18]
While Citrix describes CVE-2026-88779 as a DoS vulnerability, there is some indication it may also be exploitable for remote code execution.
Sources
11 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comCitrix patches NetScaler SAML zero-day exploited in attacks
1 article · October 4, 2026
- cisa.govCISA Adds One Known Exploited Vulnerability to Catalog
1 article · October 4, 2026
- cyberscoop.comCitrix discloses third actively exploited NetScaler zero-day in less than a week
2 articles · October 5, 2026
- infosecurity-magazine.comCitrix NetScaler Targeted Via New Zero Day
1 article · October 5, 2026
- nakedsecurity.sophos.comCitrix NetScaler vulnerability (CVE-2026-88779) in active exploitation
1 article · October 4, 2026
- orca.securityCitrix NetScaler Zero-Day Exploited in the Wild Crashes SAML Authentication Services
1 article · October 5, 2026
- scworld.comNew Citrix Netscaler zero-day exploited just days after recent attacks
1 article · October 5, 2026
- securityaffairs.comU.S. CISA adds Citrix NetScaler flaw to its Known Exploited Vulnerabilities catalog
1 article · October 5, 2026
- securityweek.comExploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier
2 articles · October 4, 2026
- thehackernews.comNew NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline
2 articles · October 5, 2026
- therecord.mediaUS, Australia warn of latest Citrix vulnerability after NetScaler advisory
1 article · October 5, 2026
Topics and entities
Topics
- Edge and IoT Device Security
- SAML authentication
- Zero-Day Exploitation
- Vulnerability Management