Monday, October 5, 2026 — 1 issue requires action. If you run none of the software below, you are done.

Affects: Citrix NetScaler ADC/Gateway

1. Unauthenticated memory overflow in Citrix NetScaler ADC and Gateway lets remote attackers crash appliances (CVE-2026-88779)

CISA KEV (due 2026-10-07) · DENIAL OF SERVICE · HIGH · CVSS 8.7

Citrix shipped emergency fixes on 2026-10-04 and CISA added the flaw to KEV the same day with a 2026-10-07 remediation deadline; teams that leave NetScaler appliances on vulnerable builds face unauthenticated remote crashes of their remote-access and SAML authentication front door, and researchers are still investigating whether the memory overflow can be pushed to code execution.

A memory buffer bounds flaw in NetScaler ADC and NetScaler Gateway can be triggered over the network without credentials or user interaction (CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) to cause a denial of service. Reports indicate the attacks knock SAML-configured deployments offline, and researchers are examining whether the same bug can be leveraged for remote code execution.

Affected: NetScaler ADC < 14.1-73.41; NetScaler ADC < 13.1-64.28; NetScaler ADC FIPS < 14.1-73.41; NetScaler ADC FIPS < 13.1-37.282; NetScaler Gateway < 14.1-73.41; NetScaler Gateway < 13.1-64.28

How to Test: Confirm the installed NetScaler ADC / Gateway build on each appliance and compare it against the fixed builds (14.1-73.41, 13.1-64.28, 13.1-37.282 FIPS); any lower build in the 14.1 or 13.1 trains is affected. Per the reports, prioritize appliances configured for SAML authentication. Check for unexplained crashes, process restarts, or service outages on internet-facing NetScaler instances since early October and review access logs on those appliances for anomalous unauthenticated requests. Note that the vendor advisory CTX697174 could not be retrieved for additional indicators at the time of writing.

How to Patch: Upgrade NetScaler ADC and NetScaler Gateway to 14.1-73.41 or later, or 13.1-64.28 or later; upgrade NetScaler ADC FIPS to 14.1-73.41 or 13.1-37.282 or later. CISA requires federal agencies to remediate by 2026-10-07 and advises discontinuing use of the product if mitigations cannot be applied.

Evidence: CISA KEV · VulnCheck KEV · CISA SSVC: active · CISA KEV addition alert based on evidence of active exploitation · BleepingComputer: emergency updates for NetScaler DoS exploited in zero-day attacks · The Hacker News: NetScaler zero-day exploited in targeted attacks against SAML deployments

Full entry with sources →

Read on the web · Every past edition

The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.

Spot an error, or an exploit we missed? Reply here or email [email protected].