CVE-2026-88779: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

The Hacker News reports that the flaw carries a CVSS score of 8.7 out of 10.0[2]. SOC Prime says that Citrix classifies the underlying weakness as CWE-119, Improper Restriction of Operations within the Bounds of a Memory Buffer.[3]According to The Register, the bug only affects NetScaler ADC and Gateway appliances configured as a SAML (Security Assertion Markup Language) service provider or identity provider[4]. In a blog post quoted by BleepingComputer, Citrix said it "has observed targeted attacks on unmitigated NetScaler deployments which can lead to Denial of Service"[1].BleepingComputer reports that security researcher Kevin Beaumont later said the activity appeared to go further than just denial-of-service, after finding that one of his patched honeypots was running a downloaded malware payload.[1] SOC Prime, however, reports that reports of scripts intended to deploy web shells or obtain appliance data did not establish that those payloads actually executed through this flaw.[3]The Register reports that CISA confirmed CVE-2026-88779 was under active exploitation and ordered federal agencies to patch the bug by Wednesday.[4] SOCRadar gives the deadline as October 7, 2026[5].Citrix's security bulletin lists the fixed builds as NetScaler ADC and NetScaler Gateway 14.1-73.41 and later releases · NetScaler ADC and NetScaler Gateway 13.1-64.28 and later releases of 13.1[6]. According to watchTowr, appliances already patched under an earlier NetScaler security bulletin still need this separate update if they use SAML authentication.[7]The Register says that Citrix did not answer our questions about CVE-2026-88779 - including how many instances have been affected and what attackers are doing after exploiting the bug[4].