[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [QUIET] · [TECHNOLOGY]

7 clusters · 44 sources · 55 days · First seen · Last updated

NetScaler product security vulnerabilities

Overview

Cloud Software Group has released emergency security updates to address several vulnerabilities in NetScaler ADC and NetScaler Gateway products. Among the initial critical zero-day vulnerabilities were CVE-2026-88771, a command-injection flaw, and CVE-2026-88772, a memory overflow vulnerability, both carrying a CVSS score of 9.5. These flaws have faced active global exploitation, with threat actors targeting government, financial, education, and legal sectors across North America and Europe. In the Netherlands, healthcare institutions and the national government took preventive measures, while Finland’s Cyber Security Centre issued warnings regarding domestic and international data breaches. CISA has added these vulnerabilities to its Known Exploited Vulnerabilities catalogue, mandating that U.S. federal agencies apply fixes. Expanding the scope of the security crisis, Citrix has identified a new high-severity memory overflow vulnerability, CVE-2026-88779, which carries a CVSS score of 8.7. This vulnerability has been identified in targeted zero-day attacks that can result in a denial-of-service (DoS) condition, potentially leaving affected services unavailable if triggered repeatedly. The flaw specifically affects customer-managed deployments where SAML authentication is configured as either a service provider (SP) or an identity provider (IdP). Citrix stated it has not identified any impact on the integrity of customer data. CISA has added CVE-2026-88779 to its Known Exploited Vulnerabilities catalog, requiring federal agencies to apply patches by October 7, 2026. Citrix has urged all customers to apply available fixes immediately to mitigate risks of remote code execution and unauthorized network access. More recently, Citrix released patches for a critical memory overflow vulnerability, CVE-2026-107406, which carries a CVSS score of 9.5. This flaw could allow for remote code execution (RCE) or denial-of-service (DoS) attacks and impacts NetScaler ADC, NetScaler Gateway, and Secure Private Access Hybrid deployments. Exploitation depends on specific configurations where instances act as a SAML identity provider (IdP) or service provider (SP).

Entities

Citrix · NetScaler · CISA · Australian Cyber Security Centre · WatchTowr

Claims

What the coverage asserts, and how many sources carry each claim.

Timeline

  1. [TECHNOLOGY] 5 sources
    Citrix patches critical NetScaler vulnerability

    Citrix has patched a critical 9.5 CVSS vulnerability in NetScaler ADC and Gateway that could allow remote code execution or denial-of-service in SAML configurations.

  2. [TECHNOLOGY] 6 sources
    Citrix NetScaler vulnerabilities patched following active exploitation

    Citrix has patched several actively exploited zero-day vulnerabilities in NetScaler products, including two critical RCE flaws and a SAML-related memory overflow affecting federal agencies.

  3. [TECHNOLOGY] 2 sources
    Cyber Security Centre warns of Citrix vulnerabilities exploited in Finland

    Finland's Cyber Security Centre warns of critical Citrix NetScaler vulnerabilities exploited in data breaches, noting that simple patching may not remove attackers who gained persistent access via zero-day hits

  4. [TECHNOLOGY] 10 sources
    Citrix NetScaler faces global exploitation of two critical zero-day vulnerabilities

    Attackers are exploiting two critical zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772) in Citrix NetScaler products to gain root access and deploy web shells globally.

  5. [TECHNOLOGY] 26 sources
    Citrix patches critical NetScaler zero-day vulnerabilities

    Citrix has patched eight vulnerabilities in NetScaler products, including two critical zero-days (CVE-2026-88771 and CVE-2026-88772) being actively exploited to allow remote code execution.

  6. [TECHNOLOGY] 2 sources
    Citrix NetScaler vulnerabilities enable session hijacking and MFA bypass

    Threat actors are exploiting critical vulnerabilities in Citrix NetScaler ADC and Gateway products to hijack sessions and bypass multi-factor authentication, prompting urgent global patching advisories.

  7. [TECHNOLOGY] 7 sources
    NetScaler faces critical vulnerabilities allowing authentication bypass

    Critical vulnerabilities in NetScaler ADC and Gateway allow for authentication bypass and remote code execution, posing severe risks to enterprise network security.

Sources

all-about-security.de · archynewsy.com · bankingjournal.aba.com · blog.0patch.com · businesstechweekly.com · cert.ug · compsmag.com · computable.nl · cybernoz.com · dawn.fi · de.tenable.com · dev.to · dijitaliyidir.com · flagthis.com · govtechreview.com.au · ipaddisti.it · it-boltwise.de · it-connect.fr · itnews.com.au · masstransitmag.com · mindef.gov.sg · minutodaseguranca.blog.br · mobiili.fi · moncloa.com · networkworld.com · nos.nl · omroepbrabant.nl · oosterhout.nieuws.nl · piyolog.hatenadiary.jp · saferworld.org.uk · scan.netsecurity.ne.jp · security-insider.de · security.nl · securityaffairs.com · smartermsp.com · socprime.com · technadu.com · technologydecisions.com.au · thecyberexpress.com · thehackernews.com · theregister.com · tilburgnieuwsjournaal.nl · tpo.nl · version2.dk

This summary has been updated 13 times: see revision history