Citrix issues emergency updates for NetScaler zero day vulnerability

Citrix has released emergency security updates for a zero-day vulnerability tracked as CVE-2026-88779 in NetScaler ADC and NetScaler Gateway appliances, BleepingComputer reported. The flaw has already seen active exploitation in zero-day attacks. [1][2]

The vulnerability involves a memory buffer flaw that affects appliances configured to use Security Assertion Markup Language authentication with Gateway. According to BleepingComputer, the security flaw causes denial-of-service conditions, while researchers are actively investigating whether attackers can leverage it for remote code execution. [1]

Reports from CyberSecurityNews and GBHackers indicate that NetScaler appliances have been observed rebooting repeatedly following the installation of the zero-day patch. Security Assertion Markup Language metadata standard, which defines deployment configurations for trust and interoperability, was published by OASIS in 2005. [3][7][8]

System administrators using affected NetScaler ADC and Gateway instances are advised to apply the emergency security updates provided by Citrix immediately to mitigate potential crash triggers and remote exploitation attempts. [1][6]