🚨 ACTIVE EXPLOITATION
- UPDATE: Citrix discloses third exploited NetScaler zero-day, CVE-2026-88779, in SAML deployments
Citrix has disclosed a third actively exploited NetScaler zero-day, CVE-2026-88779, a denial-of-service flaw affecting SAML-enabled deployments.- Affects Citrix NetScaler ADC and NetScaler Gateway deployments configured for SAML authentication; not exploitable on default configurations without SAML.
- CVE-2026-88779 causes denial of service; a single specially crafted request can knock an appliance offline, and exploitation is occurring in the wild.
- Exploitation attempts contain shellcode suggesting attackers aim for remote code execution, possibly chained with CVE-2026-88771.
- It is the third publicly exploited NetScaler zero-day in two weeks, following critical RCE flaws CVE-2026-88771 and CVE-2026-88772 (both CVSS 9.5), fixed in bulletin CTX697096 on September 27, 2026.
- CISA added CVE-2026-88779 to its Known Exploited Vulnerabilities catalog on October 4, 2026; Citrix released fixed builds in bulletin CTX697174 on October 3.