Citrix released emergency updates early Sunday for a third NetScaler zero-day exploited in attacks, a memory overflow flaw in appliances that use SAML authentication, BleepingComputer reported Sunday. The bug, CVE-2026-88779, hit devices that administrators had patched only days earlier for two other zero-days, and CISA added it to its Known Exploited Vulnerabilities catalog the same day.

What Happened

The vulnerability affects NetScaler ADC and NetScaler Gateway appliances configured as a SAML service provider or SAML identity provider. Citrix rates it 8.7 on the CVSS scale and describes it as a memory overflow that can lead to denial of service. The company said it has observed targeted attacks on unmitigated deployments but has not found an impact on the integrity of customer data. It has not released technical details of the attacks.

Fixed builds are 14.1-73.41 and 13.1-64.28. FIPS customers should move to 14.1-73.41 FIPS, and customers on the 13.1 FIPS branch to 13.1-37.282. Citrix is also offering Global Deny Lists that block IP addresses tied to the attacks.

RelatedCISA Orders Agencies to Fix Exploited Palo Alto Firewall and Cisco Email Gateway Flaws by Saturday

The problem surfaced Thursday, when administrators reported appliances running 14.1-73.37, a build that fixed the earlier flaws, rebooting unexpectedly. One administrator found login requests with crafted usernames containing shell commands that tried to download a payload from 213.209.159[.]55, save it and run it, though it was not confirmed that the payload executed. Citrix published a security notice Friday and shipped the fixes Sunday.

Why It Matters

Organizations that patched for CVE-2026-88771 through CVE-2026-88778 are not covered. Citrix told customers who meet the SAML preconditions to upgrade again, which means another maintenance window for teams that only just finished the last round.

There are also signs the flaw may do more than crash devices. Security researcher Kevin Beaumont said one of his patched honeypots ended up running a downloaded malware binary, and he described the activity as potentially another "PitScaler." SecurityWeek reported that one user recovered a script that tried to plant web shells, persist across reboots and steal configuration files and backups. watchTowr Labs said it had reproduced the vulnerability but has not published details.

Context

The new bug extends weeks of attacks on NetScaler. Two earlier zero-days, CVE-2026-88771 and CVE-2026-88772, led some customers to take appliances offline, and Mandiant has linked those intrusions to suspected state-backed hackers. SecurityWeek said CVE-2026-88779 is the sixth exploited NetScaler vulnerability CISA has added to its catalog in 2026.

Citrix's wording has precedent. CVE-2025-6543, a NetScaler flaw disclosed last year, was first described as a memory overflow leading to denial of service before later attacks showed it could be used for remote code execution.

What to Watch

Federal civilian agencies must mitigate the flaw by Oct. 7 under CISA's directive. Researchers are still working to establish whether CVE-2026-88779 allows code execution; a writeup from watchTowr or a change in Citrix's description would settle that question. Administrators who saw unexplained reboots should treat their appliances as potentially compromised and check for web shells and persistence, not just install the update.