Citrix has disclosed a fresh actively exploited vulnerability in its NetScaler ADC and NetScaler Gateway appliances, tracked as CVE-2026-88779. The memory overflow flaw can crash authentication gateways with a single specially crafted request, producing a denial-of-service condition. Citrix confirmed the issue late Friday, released a security advisory with patches by Saturday night, and urged customers to install updates immediately. The company said it observed targeted attacks on unmitigated deployments, and that repeated exploitation can keep the affected service unavailable.

watchTowr's head of threat intelligence Jake Knott said exploitation is already occurring in the wild, and that disrupting an authentication gateway prevents legitimate users from reaching services behind it. According to CyberSecurityNews, researcher Kevin Beaumont separately reported a downloaded malware binary running on a patched honeypot, while administrators observed patched appliances rebooting after crafted SAML traffic crashed the nsaaad authentication service — though Citrix's confirmed vendor assessment is denial of service, with no identified impact on customer data integrity. Citrix has published an indicator-of-compromise script, though Knott cautioned a clean result is not definitive proof of safety.

The new flaw sits inside a broader wave of NetScaler attacks. Dozens of companies across multiple sectors, plus government agencies, were compromised in the earlier September zero-day attacks by suspected state-linked actors, and Cybersecurity Dive reports the Shadowserver Foundation identified more than 20,000 exposed, potentially vulnerable instances. Google Threat Intelligence Group and Mandiant identified custom web shells including Whipshot for command and control and Slapshot for persistence, and CISA released Sigma detection rules on Friday because patching alone may not remove infections where attackers wiped local logs.

CISA added CVE-2026-88779 to its Known Exploited Vulnerabilities catalog, ordering federal civilian agencies to apply patches by Wednesday, October 7, under Binding Operational Directive 22-01. Fixed builds are 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, and 13.1-37.282 or later. Organizations unable to upgrade immediately can deploy Citrix's Global Deny List signatures to reduce exposure on versions 14.1-73.37 through 73.40 and 13.1-64.23 through 64.27, provided virtual patching is enabled — but Citrix says upgrading remains necessary wherever possible.