If Citrix NetScaler were a sitcom character, its catchphrase would be "not again." Barely a week after two actively exploited zero-days, the edge appliance that sits in front of a big slice of corporate America's remote access has a third, and this time attackers are using it to knock boxes offline.

Three Strikes, One Memory Buffer

CISA added CVE-2026-88779 to its Known Exploited Vulnerabilities catalog on October 4, giving federal civilian agencies until today, October 7, to deal with it and check for signs of compromise. It's a memory overflow bug in NetScaler ADC and NetScaler Gateway, and Citrix has confirmed "targeted attacks on unmitigated NetScaler deployments which can lead to Denial of Service." Researchers have also seen attempts to download and install webshells, although successful remote code execution hasn't been confirmed.

Not every box is exposed: exploitation requires on-premises deployments with SAML authentication configured (as either service provider or identity provider) along with Gateway or AAA functionality. Fixed builds are 14.1-73.41 and 13.1-64.28, with matching FIPS and NDcPP releases. Citrix has also pushed Global Deny List signatures to block known malicious IPs and published an indicator-of-compromise script through NetScaler Console. The bug joins CVE-2026-88771 and CVE-2026-88772, the two zero-days CISA warned about on September 27.

"Just a DoS" Is Doing a Lot of Work

It's tempting to file a denial-of-service bug under "annoying, not dangerous." Don't. When your VPN gateway goes down, so does your remote workforce, and attackers who are also trying to drop webshells clearly aren't there just to cause a nuisance. Crashing an appliance can also be a handy way to poke at it, cover your tracks or trigger a failover to something weaker.

The bigger lesson is about edge devices in general. Firewalls, gateways and load balancers sit outside most of your monitoring, run firmware nobody enjoys updating, and hold the keys to everything behind them. Three exploited NetScaler bugs in roughly a week is a sign that your patch process for those boxes needs to run in days, not "next maintenance window."

Patch it, run the IoC script, and then honestly ask yourself how long it would have taken your team to notice.

Every stack has a front door somewhere, whether it's a VPN gateway or a forgotten admin login, so if you'd like a second pair of eyes on yours, reach out and we'll look at it together.

Source: Help Net Security