Search: CVE-2026-88779

CVE-2026-88779 is a high-severity memory overflow vulnerability affecting NetScaler ADC and NetScaler Gateway products. The flaw exists in versions prior to 14.1-73.41 and 13.1-64.28 (including specific FIPS and earlier builds). Exploitation can lead to denial of service without requiring authentication or user interaction. The vulnerability has been publicly disclosed and is known to be exploited in the wild. Fixed versions are available.

In October 2026, Citrix NetScaler ADC appliances running affected 14.1 builds were compromised through a chain of two vulnerabilities: CVE-2026-88771 and CVE-2026-88779. Attackers achieved root code execution by exploiting a pre-authentication log-poisoning/RCE vulnerability and a SAML-parsing crash. The intrusion involved deploying PHP web shells, modifying system shells, creating cron jobs, and establishing boot hooks for persistence. Additional tools included TCP session managers, HTTP tunnels, and reverse agents for command-and-control. Attackers used a Go-based reconnaissance tool to map internal infrastructure and synchronized implants across appliance pairs to maintain persistence. The campaign exfiltrated NetScaler configurations, historical data, and key material, evolving from initial access to a persistent internal reconnaissance platform.