Citrix Patches Actively Exploited NetScaler Zero-Day as Researchers Spot Malware Payloads

Citrix rolled out emergency updates early Sunday for CVE-2026-88779, a zero-day actively exploited against unmitigated NetScaler ADC and Gateway appliances. The memory buffer flaw carries an 8.7 CVSS score and targets systems configured with SAML authentication. While Citrix officially described it as a denial-of-service issue, cybersecurity researchers reported patched honeypots downloading malware payloads, pointing directly to remote code execution. Administrators who recently updated their firmware to patch previous vulnerabilities are forced to upgrade their systems all over again. CISA immediately added the vulnerability to its Known Exploited Vulnerabilities list with an October 7 mitigation deadline for federal agencies. "So on one of the honeypots it’s running a downloaded (malware) binary. Both were patched, so new vuln." — Kevin Beaumont