New NetScaler zero-day causes SAML appliances to reboot

Administrators reported that fully patched NetScaler ADC and NetScaler Gateway systems began rebooting repeatedly on Friday after exploitation of a newly disclosed zero-day. Citrix confirmed the vulnerability and noted active exploitation against some deployments.

Citrix classified the flaw as a memory overflow issue that affects NetScaler instances configured as a SAML service provider or identity provider. Citrix wrote in a blog post: “Citrix has observed targeted attacks on unmitigated NetScaler deployments which can lead to Denial of Service. If the condition is triggered repeatedly, the service may remain unavailable. Our analysis indicates that this issue affects service availability, and we have not identified an impact on the integrity of customer data.”

Security researcher Kevin Beaumont labeled the cluster of NetScaler bugs “PitScaler” and called this new issue “PitScaler 2.” Beaumont reported exploitation attempts against patched honeypots and observed at least one honeypot download a malware binary. Administrators who reviewed device logs found authentication requests that contained shell commands hidden in the username field, apparently intended to retrieve and run a script on the appliance.

An administrator who obtained a copy of the script said it attempted to install persistent web shells, survive reboots and upload device configuration files and backups. That administrator added there was no definitive proof the script executed successfully on production devices.

Before Citrix issued additional fixes and mitigations, some customers powered down appliances to stop the crashes, and support queues grew as organizations sought guidance. Administrators who installed earlier patches for related NetScaler bugs reported ongoing instability until Citrix released further updates and configuration guidance.

CVE-2026-88779 was added to the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog on October 4, with CISA directing federal agencies to address the flaw by October 7. CISA has added six NetScaler vulnerabilities to the catalog in 2026. The new issue surfaced days after disclosure and exploitation of two other NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772.

Citrix has published patches and recommended mitigations for affected releases and urged operators running SAML-enabled ADC and Gateway instances to apply updates, harden configurations and monitor authentication logs for suspicious activity. Security teams and researchers continue to monitor for further exploitation and any evidence that attackers have moved from causing service disruption to executing code on appliances.