CISA flags new exploited NetScaler flaw as attackers crash appliances (CVE-2026-88779)

Key Points:

• CVE-2026-88779 is a newly identified memory overflow vulnerability in Citrix NetScaler that can lead to Denial of Service (DoS) attacks, affecting service availability.
• The vulnerability impacts specific versions of Citrix NetScaler ADC and Gateway, with reports of crashes and reboots following recent patches. Attackers are attempting to exploit this flaw to install webshells.
• It is recommended that organizations upgrade to fixed versions immediately and utilize the Global Deny List feature to block known malicious IP addresses. Administrators should also use the provided indicator of compromise script to check for any signs of exploitation.

Technical Details: CVE-2026-88779 can be exploited on on-premises NetScaler deployments configured for SAML authentication. The vulnerability does not appear to compromise customer data integrity.

MITRE ATT&CK Techniques:

• None mentioned

IOCs Mentioned:

• None mentioned