Loading story…
Citrix NetScaler customers reported repeated reboots after installing build 14.1-73.37, the emergency update for actively exploited vulnerabilities CVE-2026-88771 and CVE-2026-88772, known as “Pitscaler.” Crafted SAML authentication traffic reportedly crashes the nsaaad service and can trigger watchdog-driven restarts, creating a potential denial-of-service condition. Subsequent reporting described an apparent new zero-day exploit circulating on October 2: researcher Kevin Beaumont reported a downloaded malware binary running on a patched honeypot and suggested a possible bypass of the earlier fixes. watchTowr Labs said it reproduced the vulnerability, reportedly affecting the latest NetScaler version and involving large volumes of SAML requests. The reboot reports alone do not establish compromise or a patch bypass.
Citrix acknowledged a newly observed SAML issue and said engineering and support teams were investigating and preparing a security bulletin and fixed build. No new CVE, final fixed-build number, or effective countermeasure was reported as available at publication. Administrators should preserve crash logs and forensic evidence, correlate failures with authentication traffic, verify patch levels across all appliance nodes, and monitor Citrix advisories for mitigation and release guidance. Investigations should distinguish service crashes from evidence of code execution and check for persistence from compromises predating the emergency update.
See which actors are running it and whether you're in range.
8 events from the most recent confirmed update back to the earliest known activity.
An exploit for an apparent new NetScaler vulnerability reportedly began circulating on the evening of October 2, 2026. The vulnerability was reported to affect the latest operating-system version and to be triggerable through large volumes of SAML requests.
Citrix characterized the SAML-related reboot behavior as configuration-dependent and distinct from CVE-2026-88771 and CVE-2026-88772, stating that it does not indicate a bypass of the existing fixes. It advised customers to retain the security patches and review affected Gateway and AAA SAML configurations while a corrected build remained pending.
Citrix acknowledged the issue, said its engineering and support teams were investigating, and advised affected customers to contact support and review temporary SAML deployment guidance. It said a security bulletin and fixed build were being prepared, but the reported notice supplied no new CVE identifier or final fixed-release number.
watchTowr Labs stated that its team had successfully reproduced the apparent new NetScaler vulnerability.
Security researcher Kevin Beaumont reported that a downloaded malware binary was running on one of his NetScaler honeypots and said both honeypots had been patched. He suggested that the apparent new vulnerability could bypass the Pitscaler fixes, a claim not established by the separate reboot reports.
Administrators reported repeated nsaaad authentication-service crashes and watchdog-driven appliance restarts after installing the emergency update, with one report involving several customers and severity-one support cases. The failures appeared associated with crafted SAML authentication traffic, but the reboot reports alone did not establish compromise or a bypass of the earlier fixes.
Citrix released NetScaler build 14.1-73.37 as an emergency update for CVE-2026-88771 and CVE-2026-88772. Bulletin CTX697096 also listed build 13.1-64.23 and corresponding FIPS or NDcPP releases as fixes.
Citrix confirmed exploitation of CVE-2026-88771 and CVE-2026-88772 against unpatched systems. Earlier reporting described root access, hidden web shells, and internal tunneling associated with the exploitation campaign.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
decipher.sc
Open sourceheise.de
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citrix released fixes for six vulnerabilities in **NetScaler ADC** and **NetScaler Gateway**, including **CVE-2026-8451**, a high-severity out-of-bounds read flaw that can leak sensitive memory from appliances configured as a **SAML Identity Provider**. The bug affects customer-managed NetScaler ADC, Gateway, and related **FIPS/NDcPP** variants, and can expose memory contents in the `NSC_TASS` cookie via malformed requests to the `/saml/login` endpoint. Other patched issues include **CVE-2026-8452**, **CVE-2026-8655**, **CVE-2026-10816**, **CVE-2026-10817**, and **CVE-2026-13474**, covering risks such as arbitrary file reads, memory corruption, and denial of service, including a new **HTTP/2 Bomb** attack. Security researchers and defenders reported that **CVE-2026-8451** was exploited in the wild less than 24 hours after public disclosure, with Lupovis observing threat actors scanning exposed NetScaler systems and sending exploit payloads immediately after receiving valid `200 OK` responses. The observed activity matched public technical details released by watchTowr, using malformed SAML `AuthnRequest` data padded to trigger the overread condition. Government and industry advisories urged organizations to patch immediately, disable **SAML IdP** where patching is not possible, review `/saml/login` traffic and `NSC_TASS` cookie values for signs of compromise, restrict management exposure, and follow Citrix incident guidance if exploitation is suspected.
Jul 9, 2026
Attackers have begun attempting to exploit **CVE-2026-19490**, a critical authentication-bypass vulnerability in Citrix NetScaler ADC and NetScaler Gateway. Remote, unauthenticated actors can bypass authentication on susceptible appliances configured as AAA virtual servers or Gateway services when affected firmware versions and SAML Action settings are present; sensor data from Previdian confirms exploitation attempts, though not confirmed successful compromises. Citrix issued fixes on August 19 and urged customers to upgrade affected appliances. Australia’s ACSC and Belgium’s national cybersecurity coordination center have also called for urgent patching, warning that internet-facing edge devices are frequent initial-access targets. Organizations should identify exposed NetScaler instances and vulnerable SAML/VPN configurations, apply the relevant updates, and continue monitoring appliances after remediation. Citrix also disclosed **CVE-2026-19489**, a memory-overflow flaw affecting deployments using SIP ALG with Large Scale NAT groups.
Sep 4, 2026
Citrix released security updates for **NetScaler ADC** and **NetScaler Gateway** to fix two critical vulnerabilities, **`CVE-2026-19490`** and **`CVE-2026-19489`**, affecting internet-facing application delivery and remote access infrastructure. `CVE-2026-19490` is an authentication bypass flaw with a **CVSS v4.0 score of 9.3** that can be exploited remotely by an unauthenticated attacker with low complexity and no user interaction, while `CVE-2026-19489` is a memory overflow issue that can lead to service disruption and other unpredictable behavior. Vendor guidance ties both issues to Citrix bulletin **`CTX696939`**. Affected versions include NetScaler ADC and Gateway **14.1 before 14.1-73.32** and **13.1 before 13.1-63.21**, with additional impact noted for **NetScaler ADC FIPS before 14.1-73.32 FIPS** and **13.1-37.277 FIPS/NDcPP**. Finnish authorities and Rapid7 said they were not aware of active exploitation at publication time, but both urged organizations to patch immediately because exposed Citrix edge devices are frequent high-value targets. Citrix also published version-specific remediation guidance and configuration checks to help customers determine whether their deployments meet the prerequisites for exploitation.
Aug 22, 2026