CITRIX NETSCALER SECURITY SNAFUS GET EVEN WORSE AMID MORE 0-DAY REPORTS

Summary from the TLDR InfoSec newsletter

A single crafted request knocks NetScaler ADC and Gateway appliances offline through CVE-2026-88779, a memory overflow zero-day affecting deployments configured as a SAML service provider or identity provider. CISA confirmed active exploitation, and watchTowr told The Register it suspects attackers are crashing appliances deliberately to speed up exploitation of CVE-2026-88771, one of eight NetScaler bugs disclosed September 27. Apply Citrix's fixed build or interim mitigation, starting with Gateway and AAA virtual servers that have SAML enabled, and run Citrix's IOC script while treating a clean result as inconclusive.