Citrix issued an advisory telling administrators to immediately patch a critical memory-overflow vulnerability in NetScaler ADC and NetScaler Gateway appliances, tracked as CVE-2026-107406. The bug can allow remote code execution or crash devices via denial-of-service, but only affects appliances configured as SAML Identity Provider or Service Provider. Citrix said it has not detected any active exploitation so far and listed specific firmware versions customers should upgrade to.
bleepingcomputer.com
· 2026-10-09
Citrix has released emergency firmware updates for NetScaler ADC and Gateway appliances to fix CVE-2026-88779, a memory buffer vulnerability in SAML authentication with a CVSS score of 8.7. The company confirmed the bug has already been exploited in targeted attacks against unpatched devices, causing denial-of-service outages, and said it has found no evidence of customer data being compromised. Fixed versions include 14.1-73.41 and 13.1-64.28, with separate builds for FIPS and NDcPP customers.
bleepingcomputer.com
· 2026-10-04
Citrix patched eight NetScaler vulnerabilities, including two actively exploited zero-days, after researchers reported RCE attacks scanning for vulnerable installations and urged customers to take systems offline immediately. Citrix instead advised customers to upgrade promptly rather than disconnect servers, and the two zero-days continued to be exploited despite the patch. Separately, Kiteworks told customers to proactively take systems offline based on intelligence of an imminent attack before confirming the next day that only about 1% of customers were actually affected.
darkreading.com
· 2026-10-02
Mandiant and other security firms say attackers began exploiting an unpatched Citrix NetScaler flaw, tracked as CVE-2026-88772, in early September to install custom web shells and tunneling malware, gain root access, steal credentials, and move into internal networks. Victims span government, financial services, education, legal, and professional services organizations in North America and Europe. Citrix disclosed two related zero-days, CVE-2026-88771 and CVE-2026-88772, on Sunday and released patches after researchers including GreyNoise and watchTowr flagged active exploitation.
bleepingcomputer.com
· 2026-09-29
Citrix disclosed CVE-2026-88771 and CVE-2026-88772, both scoring 9.5 on the CVSS scale, affecting default configurations of its NetScaler ADC and Gateway products. Citrix confirmed exploits against unmitigated deployments and urged customers to patch immediately, though public warnings of attacks had circulated online since September 25, days before the formal disclosure.
darkreading.com
· 2026-09-29
CISA has directed federal agencies to fix two critical NetScaler vulnerabilities, CVE-2026-88771 and CVE-2026-88772, that Citrix confirmed are being actively exploited in zero-day attacks. Both bugs let unauthenticated attackers achieve remote code execution, with the first hitting default configurations and the second requiring DTLS, which is on by default for VPN virtual servers. Citrix has issued patches and shared indicators of compromise, after agencies like the Dutch NCSC had already been privately warning organizations to shut down affected appliances.
bleepingcomputer.com
· 2026-09-28
Citrix administrators report being privately contacted by IT suppliers, law enforcement, and cybersecurity agencies warning of two unpatched NetScaler remote code execution vulnerabilities being exploited in the wild. Security firm watchTowr confirmed the flaws are distinct from CVE-2026-19490 and CVE-2026-19489 disclosed in August, and said patches are expected next week.
bleepingcomputer.com
· 2026-09-27
Security researchers at Previdian and Belgium's national cyber center report that hackers are actively probing a critical authentication-bypass vulnerability in Citrix NetScaler appliances, tracked as CVE-2026-19490. The flaw affects NetScaler devices configured as AAA virtual servers or Gateways, and exploitation attempts began after a working proof-of-concept was posted online. Citrix patched the issue in mid-August but had not confirmed active exploitation as of its most recent advisory.
bleepingcomputer.com
· 2026-09-04
CISA has added CVE-2026-8452, a memory overflow bug in Citrix NetScaler ADC and Gateway appliances, to its Known Exploited Vulnerabilities catalog, requiring federal civilian agencies to patch by August 29. Originally described by Citrix as only enabling denial-of-service, researchers at watchTowr later demonstrated it can be exploited for root-level remote code execution, and reports indicate attackers are already deploying web shells on unpatched systems.
bleepingcomputer.com
· 2026-08-27
GoKawiil