Citrix Confirms New NetScaler Vulnerability Under Active Exploitation
Citrix confirmed on Friday that it is tracking a newly observed security issue affecting some customer-managed NetScaler deployments, even on systems that had applied all available patches. The vulnerability, later assigned CVE-2026-88779, allows attackers to trigger a denial-of-service condition that can crash NetScaler application delivery controllers and gateway devices. Citrix emphasized that the flaw is not technically linked to the vulnerabilities disclosed the previous week, CVE-2026-88771 and CVE-2026-88772, which also prompted widespread concern.
The company released a security advisory and blog post by Saturday evening detailing the issue, noting that the vulnerability carries a CVSS severity score of 8.7 out of 10. Citrix stated that its analysis indicates the flaw impacts service availability but has not been shown to compromise the integrity of customer data. The firm also provided temporary mitigations for organizations unable to apply patches immediately.
CISA Issues Emergency Directive for Federal Agencies
By Sunday, the Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent directive requiring all U.S. federal agencies to apply patches for CVE-2026-88779 by Wednesday. The order includes a mandate to conduct forensic triage on potentially affected systems to determine if exploitation occurred. CISA’s action follows confirmed reports of targeted attacks leveraging the vulnerability against unpatched NetScaler appliances.
In its advisory, Citrix acknowledged the contributions of cybersecurity firms Bishop Fox and watchTowr in identifying the issue. Benjamin Harris, founder and CEO of watchTowr, told Recorded Future News that the denial-of-service flaw enables attackers to crash systems repeatedly, potentially leaving services unavailable until mitigated.
Ongoing Exploitation of Prior Citrix Vulnerabilities Complicates Response
The emergence of CVE-2026-88779 comes as Citrix customers continue to grapple with the active exploitation of two recently patched vulnerabilities: CVE-2026-88771 and CVE-2026-88772. Despite patches being released for those flaws last week, multiple cybersecurity firms reported ongoing widespread exploitation by threat actors.
CISA issued a follow-up advisory on Friday morning warning that it has received global confirmation of active attacks on those earlier vulnerabilities. Mandiant, the Google-owned cybersecurity firm, added that it has observed evidence of compromise across organizations in North America and Europe spanning government, financial services, technology, education, and legal and professional services sectors.
These appliances — including Application Delivery Controllers, VPN gateways, and firewalls — remain attractive targets because they are exposed to the internet, sit outside the reach of endpoint detection and response (EDR) tools, and often store or process credentials that can be used to move deeper into the network.
Harris further noted that while CVE-2026-88779 has no technical connection to the prior flaws, he suspects it may have been used to deliberately crash systems in order to facilitate faster exploitation of CVE-2026-88771. This highlights a troubling trend where attackers use denial-of-service conditions as a precursor to more invasive operations.
NetScaler Devices Remain High-Value Targets for Threat Actors
Citrix NetScaler ADCs and gateways are widely deployed by large enterprises to manage traffic, perform authentication, and secure application access. Their position at the network edge makes them particularly valuable to attackers seeking initial access, as they often process credentials and are frequently absent from endpoint monitoring solutions.
The current wave of exploits underscores the persistent targeting of perimeter security devices by cybercriminals and state-linked actors alike. As organizations work to patch CVE-2026-88779 and remain vigilant against ongoing attacks on CVE-2026-88771 and CVE-2026-88772, cybersecurity leaders stress the importance of prioritizing edge device security in broader defense strategies.
Source: The Record