[REVISION HISTORY]

NetScaler product security vulnerabilities

Updated 13 times since CLSTR started tracking revisions of this situation.

What changed

2026-10-06 06:29 UTC → 2026-10-12 07:12 UTC · added ~~removed~~

Cloud Software Group has released emergency security updates to address several vulnerabilities in NetScaler ADC and NetScaler Gateway products. Among the initial critical zero-day vulnerabilities were CVE-2026-88771, a command-injection flaw, and CVE-2026-88772, a memory overflow vulnerability, both carrying a CVSS score of 9.5. These flaws have faced active global exploitation, with threat actors targeting government, financial, education, and legal sectors across North America and Europe. In the Netherlands, healthcare institutions and the national government took preventive measures, while Finland’s Cyber Security Centre issued warnings regarding domestic and international data breaches. CISA has added these vulnerabilities to its Known Exploited Vulnerabilities catalogue, mandating that U.S. federal agencies apply fixes. Expanding the scope of the security crisis, Citrix has identified a new high-severity memory overflow vulnerability, CVE-2026-88779, which carries a CVSS score of 8.7. This vulnerability has been identified in targeted zero-day attacks that can result in a denial-of-service (DoS) condition, potentially leaving affected services unavailable if triggered repeatedly. The flaw specifically affects customer-managed deployments where SAML authentication is configured as either a service provider (SP) or an identity provider (IdP). Citrix stated it has not identified any impact on the integrity of customer data. CISA has added CVE-2026-88779 to its Known Exploited Vulnerabilities catalog, requiring federal agencies to apply patches by October 7, 2026. Citrix has urged all customers to apply available fixes immediately to mitigate risks of remote code execution and unauthorized network access. More recently, Citrix released patches for a critical memory overflow vulnerability, CVE-2026-107406, which carries a CVSS score of 9.5. This flaw could allow for remote code execution (RCE) or denial-of-service (DoS) attacks and impacts NetScaler ADC, NetScaler Gateway, and Secure Private Access Hybrid deployments. Exploitation depends on specific configurations where instances act as a SAML identity provider (IdP) or service provider (SP).

Versions

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.