CVE-2026-88779: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

According to BleepingComputer, the vulnerability is a memory buffer flaw affecting NetScaler ADC and NetScaler Gateway appliances using SAML authentication with Gateway or AAA functionality[1]. In a blog post, Citrix says the flaw is categorized as CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer[2] and has a CVSS v4.0 base score of 8.7[2].Citrix said in the same post that it "has observed targeted attacks on unmitigated NetScaler deployments which can lead to Denial of Service."[2] The company added that it has "not identified an impact on the integrity of customer data."[2]BleepingComputer reports that the new attacks were first reported on Thursday after NetScaler administrators reported that recently patched appliances were unexpectedly rebooting[1].Researcher Kevin Beaumont told BleepingComputer that the activity appeared to go further than just denial-of-service, after finding that one of his patched honeypots was running a downloaded malware payload[1]. The outlet also says watchTowr Labs also confirmed that it reproduced the vulnerability[1].Citrix's security bulletin strongly urges affected customers[3] to move to builds 14.1-73.41 or 13.1-64.28 or later, or to the matching FIPS and NDcPP releases. Citrix also warned that customers who installed the fixes for CVE-2026-88771 through CVE-2026-88778 and meet the SAML preconditions should "please upgrade your deployment again"[1].According to BleepingComputer, CISA added CVE-2026-88779 to its Known Exploited Vulnerabilities catalog, confirming the flaw is being actively exploited and giving FCEB agencies until October 7 to mitigate it[1].