Exploited NetScaler flaw requires fresh updates ahead of October 7 federal deadline

Confirmed attacks put an October 7 deadline in focus

Citrix says attackers are targeting unmitigated NetScaler deployments through CVE-2026-88779, a memory-overflow vulnerability whose established impact is denial of service. Repeated triggering can keep the service unavailable. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 4, with an October 7, 2026 remediation deadline for covered federal agencies and forensic triage marked as required. [1][3][4]

This is an urgent response story on October 6, not a vulnerability first disclosed today. Customers reported crashes on October 2 despite installing preceding patches, according to The Record and The Register. Citrix's bulletin records initial publication on October 3. Together, the reporting and vendor guidance establish why administrators who recently completed an update must check their exposure again. [2][4][5][6]

SAML configuration determines which deployments are exposed

The vulnerability affects customer-managed NetScaler ADC and NetScaler Gateway when configured as a SAML service provider or SAML identity provider. Citrix rates it High, with a CVSS v4.0 score of 8.7. That configuration requirement matters: the bulletin does not establish that every NetScaler installation is vulnerable. Administrators can look for configuration entries beginning with or .