Citrix patches NetScaler SAML zero-day exploited in attacks

Overview

Citrix has issued emergency updates to address CVE-2026-88779, a denial-of-service (DoS) vulnerability affecting NetScaler (formerly ADC and Gateway) appliances. This flaw, specifically impacting the SAML component, is actively being exploited in zero-day attacks. While confirmed for DoS, the potential for remote code execution (RCE) is under investigation, making immediate patching critical for organizations utilizing these appliances.

Technical Analysis

CVE-2026-88779 is a denial-of-service vulnerability impacting Citrix NetScaler appliances when configured to use SAML. The specific mechanism of the DoS is not publicly detailed, but it has been observed in active exploitation. Researchers are currently assessing whether the vulnerability can also be leveraged for remote code execution, which would significantly escalate its impact. The vulnerability affects NetScaler appliances running specific versions, for which patches have been released.

Detection

• Monitor NetScaler appliance logs for unusual activity related to SAML authentication, including high volumes of failed or malformed SAML requests.
• Look for unexpected process creation originating from NetScaler service accounts or web server processes (e.g., httpd, nginx, or NetScaler-specific processes) that spawn shell processes (sh, bash, cmd.exe, powershell.exe).
• Observe network traffic for anomalous outbound connections from NetScaler appliances, which could indicate post-exploitation command and control (C2) activity.
• Review system resource utilization on NetScaler appliances for sudden spikes indicative of a DoS attack.

Sigma Detection Rules

NetScaler Web Server Spawning Shell (Potential RCE)

title: NetScaler Web Server Spawning Shell (Potential RCE)
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects a web server process (common on appliances) spawning a shell, indicative of successful remote code execution on a vulnerable NetScaler appliance.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    ParentImage|endswith: 
      - '/usr/sbin/httpd'
      - '/usr/local/sbin/nginx'
      - '/opt/citrix/netscaler/bin/nsd'
      - '/opt/citrix/netscaler/bin/httpd'
    Image|endswith:
      - '/bin/sh'
      - '/bin/bash'
      - '/usr/bin/python'
      - '/usr/bin/perl'
      - '/usr/bin/php'
  condition: selection
level: critical

Mitigations

1. Apply Patches Immediately: Install the latest security updates provided by Citrix for NetScaler appliances. This is the primary and most effective mitigation.
2. Monitor Appliance Logs: Implement robust logging and monitoring for NetScaler appliances, focusing on SAML authentication events and process execution.
3. Network Segmentation: Isolate NetScaler appliances on a dedicated network segment to limit potential lateral movement in case of compromise.
4. Web Application Firewall (WAF): Deploy a WAF in front of NetScaler appliances to inspect and potentially block malicious SAML requests, although specific patterns for this zero-day may not be immediately available.

References

• https://www.bleepingcomputer.com/news/security/citrix-patches-netscaler-saml-zero-day-exploited-in-attacks/

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

• T1190 — Exploit Public-Facing Application