Denial of Service Attacks Target Citrix NetScaler Vulnerability
Recent developments have put Citrix NetScaler appliances under scrutiny, as attackers have been aggressively exploiting a recently disclosed zero-day vulnerability. This vulnerability threatens to crash the devices, leading to alarming service disruptions.
On a recent Sunday, Citrix issued a security alert announcing patches to address flaws in its NetScaler Application Delivery Controller (ADC) and Gateway appliances. The vulnerability, identified as CVE-2026-88779, carries a significant CVSS score of 8.7, hinting at its potential danger. Citrix reported observing targeted attacks on unmitigated NetScaler deployments capable of causing denial of service (DoS). In its bulletin published on Saturday, the company emphasized that if the conditions triggering the vulnerability are activated multiple times, services could remain unavailable indefinitely. Notably, Citrix clarified that this vulnerability does not appear to compromise customer data integrity.
The urgency of this vulnerability prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add it to their list of Known Exploited Vulnerabilities, imposing a deadline for federal agencies to either patch the flaw or refrain from using the affected appliances. The vulnerability in question stands apart from two other zero-day vulnerabilities involving Citrix NetScaler ADC and Gateway products, which had already been under active exploitation since August. The fixes for those earlier vulnerabilities do not rectify this latest threat.
Numerous organizations rely on Citrix’s Application Delivery Controller products to facilitate remote access to enterprise and cloud applications. The Citrix NetScaler Gateway, a critical tool functioning as an SSL VPN, supports authentication and single sign-on for remote users. This dependency outlines the importance of swiftly remedial action in protecting organizational infrastructure.
CVE-2026-88779 springs forth as a memory overflow vulnerability specifically affecting SAML configurations in customer-managed environments, acting either as a SAML Service Provider (SP) or as a SAML Identity Provider (IdP). Reports of this vulnerability circulated, prompting cybersecurity firm watchTowr to successfully recreate the exploit, thereby raising alarms in the cybersecurity community.
British cybersecurity expert Kevin Beaumont also weighed in on the situation. He noted that his honeypots, using fully patched versions of Citrix software, were targeted by a barrage of “sprayed and prayed” exploits, indicative of the ongoing crisis.
Citrix’s parent company, Cloud Software Group, acted quickly, issuing patches early on a Sunday, which cover all NetScaler ADC and Gateway versions 14.1-73.41 and later, along with version 13.1-64.28 and later iterations. The company has strongly urged its customers to implement these updates immediately in light of these threats, thanking cybersecurity firms such as Bishop Fox and watchTowr for their collaboration in safeguarding users.
In a blog post, Citrix indicated that the vulnerability particularly afflicts NetScaler deployments employing SAML authentication in conjunction with Gateway or AAA functionality. They advised customers to scrutinize their NetScaler configurations, focusing on whether SAML authentication actions were in place. Notably, Citrix remarked that this flaw could only potentially affect customer-managed NetScaler ADC and Gateway appliances, asserting that the Citrix-managed cloud services were promptly updated with the necessary software enhancements.
However, Beaumont raised skepticism regarding the vulnerability’s implications, suggesting that it could potentially facilitate more than mere denial of service, hinting at the possibility of malware execution on devices. He implied this might echo a previously known memory overflow vulnerability, CVE-2025-6543, patching which Citrix had addressed last year. Yet, Citrix has not substantiated claims indicating that this vulnerability permits anything beyond system crashes.
The persistence of cyber exploitation targeting CVE-2026-88779 follows closely on the heels of two other vulnerabilities in Citrix NetScaler. These earlier flaws, cataloged with an influential CVSS score of 9.5, allow malicious actors to execute commands with scant credentials, raising concerns among users.
Cybersecurity analysts at Arctic Wolf reported that these vulnerabilities enabled attackers to execute a series of commands targeting devices, facilitating the retrieval and execution of various scripts from external servers, thereby establishing backdoor access for ongoing exploitation.
The Dutch National Cyber Security Center instructed government agencies to take their Citrix NetScaler systems offline immediately due to the elevated risks posed by the two vulnerabilities, which had already been demonstrably exploited.
These vulnerabilities were first identified by the cybersecurity firm watchTowr, leading Citrix to respond definitively with a series of patches, which were published for public consumption and promptly added to the CISA’s Known Exploited Vulnerabilities catalog. Since publicly disclosing the vulnerabilities, researchers have noted a surge in scanning and exploitation attempts across various organizations.
Now, with the release of the newest patches, Citrix extends a clarion call for all users affected by CVE-2026-88779 to undertake immediate corrective actions. The urgency to act is compounded by growing indications from watchTowr that this most recent vulnerability may have been employed deliberately to precipitate system crashes, which, in turn, would streamline exploitations of the earlier critical vulnerabilities.
This situation underscores the pressing need for vigilance and swift remedial actions in the cybersecurity landscape, as organizations strive to combat evolving threats that jeopardize operational continuity and the integrity of sensitive data.