Citrix NetScaler flaw exploited in attacks: urgent patch released for SAML deployments

What is the Citrix NetScaler vulnerability?

A new security flaw, tracked as CVE-2026-88779, has been found in Citrix NetScaler ADC and NetScaler Gateway appliances. This vulnerability affects systems that use SAML authentication (a common way for organisations to manage user logins). The flaw is a memory buffer issue, which means attackers can send specially crafted data to the device and cause it to malfunction.

Citrix released emergency patches after reports that attackers were already exploiting the flaw in the wild. The US Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue on 4 October 2026, confirming that attacks are ongoing and urging organisations to update their systems immediately [CISA↗ (opens in a new tab)][BleepingComputer↗ (opens in a new tab)][SecurityWeek↗ (opens in a new tab)].

Who is affected and what is the impact?

The vulnerability affects Citrix NetScaler ADC and NetScaler Gateway appliances that have SAML authentication enabled. Many businesses and government agencies use these devices to manage secure remote access and single sign-on. If exploited, the flaw can cause the device to crash or become unavailable, a denial-of-service (DoS) attack. This can knock critical services offline, disrupting business operations.

Citrix has stated that, so far, there is no evidence that attackers can steal or alter data using this vulnerability. However, some researchers and administrators have observed suspicious activity that could suggest attempts at remote code execution (where an attacker runs their own code on the device). As of now, this has not been confirmed by Citrix or independent security firms [BleepingComputer↗ (opens in a new tab)][SecurityWeek↗ (opens in a new tab)].

How did the attacks unfold?

Reports of attacks began on Friday, 2 October 2026, when administrators noticed that even recently patched NetScaler appliances were unexpectedly rebooting. Some logs showed authentication requests with unusual usernames containing shell commands, apparently trying to download and run malicious files. In some cases, the devices crashed repeatedly until they became unavailable.

Citrix confirmed the issue and released emergency updates for affected software versions, including 14.1-73.41 and 13.1-64.28. The company also provided a list of known malicious IP addresses to block, but stressed that installing the security update is the only reliable fix. CISA has set a deadline of 7 October 2026 for US federal agencies to apply the patch [CISA↗ (opens in a new tab)].

What should organisations do now?

Citrix and CISA recommend that all organisations using NetScaler ADC or Gateway appliances with SAML authentication apply the latest patches immediately. Administrators should check if their devices are configured as a SAML Service Provider (SP) or Identity Provider (IdP). If so, they are at risk.

Organisations should also review logs for signs of unusual authentication attempts or repeated crashes. If there is any suspicion of compromise, Citrix advises contacting their support team. CISA requires US federal agencies to conduct forensic triage to check for signs of exploitation before and after patching.

What is still unclear?

While Citrix describes the vulnerability as causing denial of service, some researchers and administrators have seen evidence that could suggest more serious exploitation, such as remote code execution or malware installation. However, these claims are not yet confirmed by Citrix or independent security firms. The technical details of how the flaw works are not fully public, as researchers are still investigating.

Practical advice for readers

• If you manage Citrix NetScaler appliances, check your version and apply the latest patch.
• Review your authentication configuration: if SAML is enabled, you are at risk.
• Monitor logs for unusual activity, especially failed logins or repeated crashes.
• Follow Citrix and CISA guidance for forensic checks if you suspect compromise.