Updated: Citrix Adds Temporary Mitigation for Actively Exploited NetScaler Vulnerability
Citrix has also published a temporary mitigation for the actively exploited CVE-2026-88779 vulnerability. Fixed versions for affected NetScaler ADC and Gateway deployments remain available.
NetScaler mitigation is a new element of the manufacturer’s response to the actively exploited CVE-2026-88779 vulnerability. Citrix said that after being alerted to the issue, it first published a temporary measure to reduce the risk while preparing and deploying a patch in parallel. The company continues to urge administrators to install the fixed versions promptly.
The U.S. agency CISA has already added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, meaning that active exploitation has been confirmed. However, the published information does not state how many organizations were attacked or provide details of the exact course of the attacks.
NetScaler mitigation is only a temporary step
CVE-2026-88779 affects customer-managed NetScaler ADC and NetScaler Gateway appliances if they have a SAML Service Provider (SP) or SAML Identity Provider (IdP) configured. In its security bulletin, Citrix classifies its impact as denial of service.
The temporary mitigation is intended to give administrators a procedure for cases where an update cannot be performed immediately. However, it does not replace moving to a fixed build. Organizations should verify the SAML configuration on affected appliances, apply the manufacturer-published measure while preparing the update, and then deploy the available fix.
According to information cited by the media, Citrix also provides a script to check for signs of compromise. However, according to the cited security researcher, a result with no findings cannot be considered definitive proof that the appliance was not compromised. The check should therefore be part of the response alongside the update, not a replacement for it.
Exploitation is confirmed, not remote code execution
Officially available materials confirm active exploitation and the risk of denial of service in the affected SAML configurations. However, it has not been publicly confirmed that CVE-2026-88779 by itself enables remote code execution.
Researchers also made claims about possibly chaining the flaw with CVE-2026-88771 or about shellcode in exploitation attempts. Citrix has not independently confirmed these claims. They therefore do not confirm the vulnerability’s technical capabilities or the scope of individual attacks.
What administrators should monitor
The priority remains deploying fixed versions on customer-managed NetScaler ADC and NetScaler Gateway appliances with SAML SP or SAML IdP enabled. For systems that cannot be updated immediately, a temporary measure published by the manufacturer is available. This should be followed by an update and a check for possible signs of compromise.
Further information may come from Citrix details about the temporary mitigation, updated indicators of compromise, or statements from Citrix and CISA about cases of compromise beyond denial of service. Confirmation or refutation of remote code execution and possible chaining with other NetScaler flaws also remains outstanding.
Sources
- Citrix Security Bulletin CTX697174 – Confirms the scope of affected products and versions, the SAML condition, the denial-of-service impact, and the available fixed builds.
- CISA Known Exploited Vulnerabilities Catalog – Confirms that CVE-2026-88779 is listed as an actively exploited vulnerability.
- The Register – Reports Citrix’s statement about the temporary mitigation before the patch was released and notes the existence of a script for checking compromise indicators.
- CyberScoop – Corroborates Citrix’s statement that the company published a mitigation and prepared a fix in parallel.
Verified and updated: 06. 10. 2026 06:23
