Netscaler admins beware: Zero-day causes crashes and code execution

Since the evening of October 2, 2026, an exploit for a new security vulnerability on Citrix NetScaler devices has apparently been circulating. The manufacturer warns in a blog post, security researchers claim to have observed malware on their test devices. Patches are not yet available at the moment.

According to British security expert Kevin Beaumont, it could be an evasion of the fix for the vulnerability disclosed last week, “Pitscaler” (CVE-2026-88771 / CVE-2026-88772). He writes: “So on one of the honeypots it’s running a downloaded (malware) binary. Both [honeypots, ed.] were patched, so new vuln.” It is apparently exploitable on the recently released latest version of the NetScaler operating system -- a zero-day.

Other experts second this: “the watchTowr Labs team has now successfully reproduced this vulnerability.” This means that just one week after the last fatal vulnerability, an exploit for NetScaler systems capable of injecting malware and attacking corporate networks is once again in circulation. The exploit can likely be executed by sending a massive number of SAML requests to a vulnerable device. users are discussing the vulnerability and its exploitation in an extensive discussion thread .

The manufacturer also commented surprisingly quickly in its blog . However, it names neither effective countermeasures nor provides a solution via patch. Affected parties should customer support. Until a patch for the zero-day is available, only increased vigilance on the holiday weekend will help. We will continuously update this report.

Just a few days ago, a zero-day attack on Citrix appliances sweetened the weekend for admins and security researchers worldwide, and before that in August .

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.