[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXKWuNXPl1F3VVI1RDTM1B9KnHg5uYIqXIpP45GBiSSI":3},{"article":4,"iocs":53,"watch_terms":63,"solutions":64,"lesson":157},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"d4ed3ae6-6692-40b6-901c-0f88c3d28dc8","New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline","new-netscaler-zero-day-exploited-in-targeted-attacks-can-knock-saml-deployments--6f62c8","Citrix has released security updates for a high-severity security flaw in NetScaler ADC and Citrix NetScaler Gateway that has been exploited as part of targeted zero-day attacks. The vulnerability, tracked as CVE-2026-88779, carries a CVSS score of 8.7 out of 10.0. \"CVE-2026-88779 is a memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway that can lead to","Citrix has released security updates for a critical zero-day vulnerability, CVE-2026-88779, affecting NetScaler ADC and Gateway. This memory overflow flaw, with a CVSS score of 8.7, can lead to denial-of-service conditions, particularly in SAML deployments. The vulnerability has already been exploited in targeted attacks, prompting CISA to add it to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by October 7, 2026.","Citrix NetScaler zero-day vulnerability (CVE-2026-88779) exploited in targeted attacks.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fnew-netscaler-zero-day-exploited-in.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhV4of0Q-gWaIOffgWXdEfAxmI1ENcyrpDSSDjBurAHSpUuAI8lASQI5wrUvL3Evb0iqA31rRywo51olFOzoWe_lQ9cwN7Sp5QQw_2h-y44n0Va4vwlRQZipZ5fkm98BRmTOoVDPTs8pUMW_ClnH2GlPobgQQ33rNzL8EBnBW84aacH3dLXdyyLW9bBEqG5\u002Fs1600\u002Fcitrix-offline.jpg","2026-10-05T06:40:19+00:00","2026-10-05T08:00:11.553713+00:00",9,[17,20,22,25,28],{"name":18,"type":19},"NetScaler ADC","product",{"name":21,"type":19},"NetScaler Gateway",{"name":23,"type":24},"Citrix","vendor",{"name":26,"type":27},"SAML","technology",{"name":29,"type":19},"NetScaler","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,46,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":47},{"id":30,"icon":32,"name":33,"slug":34},{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58,61],{"type":55,"value":56,"context":57},"cve","CVE-2026-88779","NetScaler ADC and Gateway memory overflow vulnerability exploited in targeted attacks.",{"type":55,"value":59,"context":60},"CVE-2026-88771","Previously exploited CVE for planting web shells and tunneling tools.",{"type":55,"value":62,"context":60},"CVE-2026-88772",[23,18,21],{"controls":65,"vendors":151},[66,95,123],{"slug":67,"name":68,"problem":69,"products":70},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":96,"name":97,"problem":98,"products":99},"patch-management","Automated patch management","Known holes get closed in days, not months.",[100,107,115],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":96,"product_name":104,"url":105,"description":106},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":52,"name":124,"problem":125,"products":126},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[127,135,143],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",[152],{"slug":153,"name":23,"logo_path":154,"roles":155},"citrix","\u002Fvendor-logos\u002Fcitrix.png",[156],"affected",{"slug":158,"title":159,"body":160,"framework_refs":161,"framework_notes":171},"citrix-netscaler-zero-day-actively-exploited-saml-deployments-at-risk","Citrix NetScaler Zero-Day Actively Exploited, SAML Deployments at Risk","A critical memory overflow vulnerability (CVE-2026-88779) in Citrix NetScaler ADC and Gateway is being actively exploited in targeted attacks before a patch was widely applied, making this a classic zero-day risk scenario. The flaw specifically disrupts SAML-based authentication, meaning organizations relying on NetScaler for federated identity and single sign-on could face complete authentication outages. CISA's addition to the Known Exploited Vulnerabilities catalog underscores that threat actors are actively weaponizing this flaw against real targets, not just proof-of-concept environments. This incident highlights the danger of internet-facing network appliances that are slow to patch and the cascading impact a single infrastructure component failure can have on authentication pipelines across an organization.",[162,163,164,165,166,167,168,169,170],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST RA-5: Vulnerability Monitoring and Scanning","NIST SC-5: Denial-of-Service Protection","CISA KEV Catalog: Known Exploited Vulnerabilities","ITIL: Change and Release Management (Emergency Change Procedures)","NIST CSF: RS.MI-3 Mitigation of Newly Identified Vulnerabilities",{}]