By fieldeffectsoft
Publication Date: 2026-10-06 12:19:00
At a glance:
Citrix disclosed CVE-2026-88779 after observing active exploitation against NetScaler deployments.
Exposure is limited to NetScaler deployments configured for Security Assertion Markup Language (SAML) authentication, making it more narrowly scoped than the recently exploited NetScaler zero-days.
Citrix released patches on October 3, 2026, and affected SAML-enabled deployments require the newest updates even if the September 27 NetScaler patches were already applied.
Threat summary
On October 4, 2026, the U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-88779 to its Known Exploited Vulnerabilities (KEV) catalogue after Citrix confirmed targeted attacks against unpatched Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway deployments.
Citrix disclosed the vulnerability and released fixed builds on October 3. Reports of repeated appliance crashes had emerged on October 1, before the vulnerability or patches were made…
