CVE-2026-88779: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

According to The Hacker News, Citrix has released security updates for a high-severity security flaw in NetScaler ADC and NetScaler Gateway that has been exploited as part of targeted zero-day attacks[2], and the flaw carries a CVSS score of 8.7 out of 10.0.[2]SOC Prime reports that Citrix classifies the underlying weakness as CWE-119, Improper Restriction of Operations within the Bounds of a Memory Buffer.[3] The Hacker News reports that the flaw can only be exploited when an appliance is configured either as a SAML service provider (SP) or SAML identity provider(IdP).[2]Citrix said in a blog post, quoted by BleepingComputer: "Citrix has observed targeted attacks on unmitigated NetScaler deployments which can lead to Denial of Service."[4]SecurityWeek reports that administrators initially reported reboots of fully patched NetScaler systems on Friday[1].According to BleepingComputer, researcher Kevin Beaumont said that one of his patched honeypots was running a downloaded malware payload.[4] SecurityWeek, however, reports that watchTowr determined that it's a DoS bug that can only be used to crash systems[1].Citrix's bulletin strongly urges affected customers[5] to upgrade to builds including 14.1-73.41 and 13.1-64.28 or later.According to SecurityWeek, CISA added CVE-2026-88779 to its KEV catalog on October 4, instructing federal agencies to address it by October 7.[1]