Citrix issues patches for NetScaler memory overflow flaw under active attack

Citrix has issued emergency software updates to fix a high-severity vulnerability in its NetScaler ADC and NetScaler Gateway products, CSO Online and BleepingComputer reported. The flaw is being actively exploited in zero-day attacks, according to BleepingComputer. [2][3]

tracked as CVE-2026-88779, the issue is a memory overflow buffer flaw that can cause a denial-of-service condition on affected appliances, CSO Online and BleepingComputer both reported. BleepingComputer noted that security researchers are currently investigating whether the vulnerability can also be leveraged by hackers for remote code execution. [2][3]

The memory buffer flaw specifically poses significant risks to users, InfoSecurity Magazine reported, adding that the Cybersecurity and Infrastructure Security Agency warned the issue impacts the federal government. The platform functions as an application delivery controller, incorporating features such as load balancing, content caching, and SSL offloading. [6][14]

As FTMQ Security reported earlier, the memory flaw affects appliances using SAML authentication with Gateway. Multiple outlets previously noted that appliances reboot repeatedly after applying emergency patches. [15]

CSO Online reported that the new warning comes just days after Citrix urged customers to patch a separate set of vulnerabilities that included two other actively exploited zero-day flaws. Citrix has urged administrators with NetScaler deployments to apply the latest updates to mitigate exploitation risks. [2]