Citrix Products Denial of Service Vulnerability

Back Hkcert

Citrix Products Denial of Service Vulnerability

Hkcert • October 5, 2026

Share: View original

A vulnerability was identified in Citrix Products. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition on the targeted system.

CVE-2026-88779 are being exploited in the wild. This vulnerability is caused by a memory overflow that leads to a Denial of Service. NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP to be vulnerable. Hence, the risk level is rated as High Risk.

System / Technologies affected

Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1 BEFORE 14.1-73.41

Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1 BEFORE 13.1-64.28

Citrix NetScaler ADC FIPS BEFORE 14.1-73.41 FIPS

Citrix NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.282

Before installation of the software, please visit the vendor web-site for more details.

Apply fixes issued by the vendor:

Vulnerability Identifier

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Citrix NetScaler Zero-Day Vulnerabilities Exploited In late September 2026, two critical zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772) in Citrix NetScaler ADC and Gateway were actively exploited, allowing remote code execution. The Cybersecurity and Infrastructure Security Agency (CISA) added these CVEs to its Known Exploited Vulnerabilities catalog on September 27, 2026, with a CVSS score of 9.5. Attackers utilized custom web shells named WHIPSHOT and SLAPSHOT to gain unauthorized access to affected systems. Organizations in sectors such as government, finance, and healthcare were particularly vulnerable. Citrix has since released patches for these vulnerabilities, but the urgency of the situation has raised concerns about the effectiveness of their response. The incidents highlight the ongoing risks associated with internet-exposed edge devices and the need for rapid incident response. As of October 4, 2026, the exploitation is confirmed to be ongoing, with significant operational and compliance risks reported. 78 sources 80

Extracted Entities

Attack Types (1)

Denial of Service

CVEs (1)

CWE Weaknesses (1)

CWE-120 - Classic Buffer Overflow

Platforms (2)

Citrix NetScaler ADC Citrix NetScaler Gateway