Citrix NetScaler Flaw Under Active Attack: Unpatched Appliances Risk Losing Remote Access

On 4 October 2026, Citrix disclosed a high-severity vulnerability (CVE-2026-88779, CVSS score 8.7) in its NetScaler ADC and NetScaler Gateway products. It is a memory overflow flaw. It affects appliances configured as either a SAML Service Provider or a SAML Identity Provider. If an attacker exploits it, the result can be a denial of service, which may disrupt login services and remote access for staff.

The threat is not theoretical. Citrix has observed targeted attacks against unpatched NetScaler deployments, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the flaw to its Known Exploited Vulnerabilities Catalog. The issue affects customer-managed appliances only. Citrix-managed cloud services and Citrix-managed Adaptive Authentication services are not affected, because the required updates have already been applied to those platforms.

Sophos Counter Threat Unit researchers advise organisations to identify affected systems and apply the latest Citrix security updates as soon as possible. They say internet-facing and business-critical deployments should be prioritised. SophosLabs says it continues to monitor for related activity and will deliver detections and protections as they become available. This summary is based on the opening of the Sophos article, so further details may be available in the full report.