DaystoPatch

CitrixExploited incident

NetScaler ADC and Gateway SAML memory overflow exploited for denial of service

CVE-2026-88779High, CVSS 8.7In CISA's Known Exploited Vulnerabilities catalog since 4 Oct 2026

  • Exploited before a fix
FixedFixed for every supported version 32 hours after the first public report.

Response

Silence
<1h
First public report to first vendor statement
Exposure
32h
First public report to first fix
Follow-through
32h
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Kevin Beaumont on Mastodon (cyberplace.social)CuratedQuote verified

    I can see my patched honeypots, 13.1 and 14.1, are crashing.

    created_at 2026-10-02T19:01:08.869Z. Same post: 'It looks like we may have #PitScaler 2 on our hands.' First public post found describing attacks crashing appliances already patched for CVE-2026-88771/88772.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:3e2866a005f0ca26…
    Used in metrics
    Yes
    Dispute this timestamp
    8 more sources for this moment
    Citrix advisory CTX697174ClaimedQuote verified3 Oct 2026

    Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88779

    The vendor's own disclosure.

    Source
    Citrix advisory CTX697174 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b5ce6e9d7be3bac4…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2026-88779)ClaimedQuote verified4 Oct 2026

    Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

    Added to CISA's KEV catalog on 2026-10-04.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    BleepingComputerCuratedQuote verified4 Oct 2026

    Citrix has released emergency updates for a new NetScaler denial-of-service vulnerability tracked as CVE-2026-88779 that has been exploited in zero-day attacks

    Article byline 'October 4, 2026 05:58 PM' (no time zone shown, so day precision).

    Source
    BleepingComputer news
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d202fba70a4338af…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE record CVE-2026-88779 (CNA: NetScaler)CuratedQuote verified4 Oct 2026, 02:35 UTC

    "assignerShortName":"NetScaler","dateReserved":"2026-09-10T07:14:57.370Z","datePublished":"2026-10-04T02:35:35.525Z"

    Earliest public signal that could be evidenced. BleepingComputer reports admins first described the crashes on Reddit on Friday 2026-10-02, but those posts could not be fetched (Reddit is not reachable), so that earlier signal is not recorded.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ff93ab6e2982237f…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-88779ClaimedQuote verified4 Oct 2026, 02:35 UTC

    Vulnerability in NetScaler ADC and NetScaler Gateway.

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ff93ab6e2982237f…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet4 Oct 2026, 03:43 UTC

    Citrix NetScaler has a new unauthenticated flaw (CVE-2026-88779) that lets a stranger crash the appliance.

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet4 Oct 2026, 08:21 UTC

    Citrix NetScaler CVE-2026-88779 is exploited in the wild against NetScaler SAML authentication setups. Upgrade to 14.1-73.41 now. # Citrix # NetScaler # CVE202688779 # SAML # ActivelyExploited

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Research: rapid7ClaimedQuote verified19 Oct 2026, 15:11 UTC

    Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

    Earliest mention we hold (a vetted outlet).

    Source
    Research: rapid7 research
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:5735c2d28d82d3a9…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    +<1h

    Kevin Beaumont on Mastodon (cyberplace.social), reporting a Citrix blogCuratedQuote verified

    Citrix have a blog out for

    created_at 2026-10-02T20:00:28.179Z. The post continues '#PitScaler 2 It’s a new security vuln, zero day.' and links Citrix's techzone blog 'security-update-guidance-for-netscaler-saml-authentication-deployments'. That blog returns 403 to scripts and Wayback holds only 402/403 captures, so this third-party post is the evidence that Citrix acknowledged the issue publicly by this time (upper bound).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:afa12b35eff89b3c…
    Used in metrics
    Yes
    Dispute this timestamp
    2 more sources for this moment
    Citrix advisory CTX697174ClaimedQuote verified3 Oct 2026

    Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88779

    Source
    Citrix advisory CTX697174 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b5ce6e9d7be3bac4…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE record CVE-2026-88779 (CNA: NetScaler)CuratedQuote verified4 Oct 2026, 02:35 UTC

    "assignerShortName":"NetScaler","dateReserved":"2026-09-10T07:14:57.370Z","datePublished":"2026-10-04T02:35:35.525Z"

    The bulletin CTX697174 changelog says '2026-10-03 (PST) Initial Publication'. 02:35Z on 4 Oct is 19:35 PDT on 3 Oct, which matches. The bulletin date is not added as a separate day-precision candidate because a Pacific date cannot be mapped to one UTC day.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ff93ab6e2982237f…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    +32h

    CVE record CVE-2026-88779 (CNA: NetScaler)CuratedQuote verified

    before 14.1-73.41

    R5 fix (2026-10-23): time and quote now both from the CVE record, whose description names the fixed builds. The bulletin CTX697174 (changelog '2026-10-03 (PST) Initial Publication', Wayback 20261004182004) lists the same builds. BleepingComputer: 'Early Sunday morning, Citrix released NetScaler ADC and NetScaler Gateway 14.1-73.41 and 13.1-64.28'.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ff93ab6e2982237f…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    +32h

    CVE record CVE-2026-88779 (CNA: NetScaler)CuratedQuote verified

    before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282

    R5 fix: the CVE record lists fixed builds for all four branches (14.1, 13.1, 14.1-FIPS, 13.1-FIPS/NDcPP). The record was updated 2026-10-05, so its first version is not verified.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ff93ab6e2982237f…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • NetScaler ADC
  • NetScaler Gateway
  • NetScaler ADC FIPS and NDcPP
How we built this timeline

Zero-day: BleepingComputer quotes a Citrix blog post ('Citrix has observed targeted attacks on unmitigated NetScaler deployments which can lead to Denial of Service'), and reports that crashes on fully patched 14.1-73.37 appliances were first described by admins on Friday 2 Oct 2026, before the fix. The Citrix techzone blog itself returns 403 to scripted fetches and Wayback holds only 402/403 captures, so it is not cited directly.

Only appliances configured as SAML SP or SAML IdP are affected. Citrix also offered Global Deny Lists of malicious IPs (per BleepingComputer); not recorded as a workaround because the vendor's own text could not be fetched.

Researchers investigated possible code execution; Citrix describes impact as DoS only.

Follow-up: secondary sources say a further SAML IdP flaw, CVE-2026-107406 (disclosed 8 Oct 2026, not in KEV as of the cache), affects 14.1-73.41 / 13.1-64.28 and recommend 14.1-73.46 / 13.1-64.29; not verified here and not part of this incident. Correction 23 Oct 2026: R3 search found Kevin Beaumont's Mastodon posts of 2 Oct 2026 (honeypot crashes at 19:01Z;

Citrix SAML guidance blog at 20:00Z), which are now the earliest world and Vendor statement candidates. CVE-2026-107406 (CTX697191, 8 Oct 2026) is a separate SAML IdP memory overflow; its bulletin does not describe the CVE-2026-88779 fix as incomplete, so R1 does not apply.

Related

Citrix report card