Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier

Over the weekend, Citrix NetScaler admins noticed appliances that had already been patched started rebooting unexpectedly, prompting Citrix to confirm a fresh zero-day under active attack. The flaw, CVE-2026-88779, is a memory overflow in NetScaler ADC and NetScaler Gateway when configured as a SAML SP or IdP, which Citrix says attackers are leveraging to cause denial-of-service conditions without evidence of data compromise so far. The exploitation wave arrived only days after two other actively exploited bugs, CVE-2026-88771 and CVE-2026-88772, had already forced some organizations to take their NetScaler boxes offline. Researcher Kevin Beaumont observed exploitation attempts on patched honeypots and found one running a downloaded malware sample designed to drop web shells and exfiltrate device configs, while CISA has now added CVE-2026-88779 to its KEV list, giving federal agencies until October 7 to remediate — the sixth NetScaler flaw added to that catalog in 2026.