CISA flags new exploited NetScaler flaw as attackers crash appliances (CVE-2026-88779)

CISA has added a fresh Citrix NetScaler flaw, CVE-2026-88779, to its Known Exploited Vulnerabilities list after confirming it's being actively abused to crash vulnerable appliances. The bug is a memory overflow issue affecting NetScaler ADC and NetScaler Gateway versions 14.1 before 14.1-73.41 and 13.1 before 13.1-64.28 (plus the FIPS/NDcPP builds), but only when the device uses SAML authentication alongside Gateway or AAA features. Citrix says exploitation can trigger repeated denial-of-service conditions that leave the appliance unavailable, though customer data integrity doesn't appear impacted; researchers from Bishop Fox and watchTowr flagged the issue, with reports suggesting attackers are attempting to drop webshells via a downloaded script, while reboots and crashes are also being seen after admins patched two other actively exploited zero-days, CVE-2026-88771 and CVE-2026-88772. Citrix has released Global Deny List signatures and an IOC-checking script, and CISA has given US federal agencies until October 7 to patch and verify no compromise has occurred.