Patched by Wednesday, rebooting by Friday

Wednesday 30 September was the deadline. CISA had given federal civilian agencies three days to fix two actively exploited flaws in Citrix NetScaler ADC and NetScaler Gateway, and the fixed builds were 14.1-73.37 and 13.1-64.23. On Friday 2 October, administrators who had installed them started reporting that their appliances were rebooting on their own. Some had been rebuilt from fresh images. They rebooted too.

By Sunday morning Citrix had a name for it, CVE-2026-88779, and another set of builds: 14.1-73.41 and 13.1-64.28, with separate FIPS editions. The NVD record was published at 04:16 UTC on 4 October. CISA put the flaw into its Known Exploited Vulnerabilities catalogue the same day, with a due date of Wednesday 7 October. It is the third NetScaler zero-day Citrix has confirmed in a week, and the sixth NetScaler entry the catalogue has taken in 2026.

The instruction that matters most to anyone who did the work last week came from Citrix, in its blog post and as quoted by BleepingComputer: "If you upgraded your NetScaler deployment with one of the updated software releases identified in the security bulletin for CVE 2026-88771 through CVE 2026-88778, and if you have determined that your NetScaler deployment meets the preconditions describe above, please upgrade your deployment again with the software released as part of the security bulletin for CVE-2026-88779." The precondition is SAML, the single sign-on standard. An appliance is exposed if it is configured as a SAML service provider or a SAML identity provider, which an administrator can check for in two lines of configuration.

Citrix describes the flaw as an availability problem. "Citrix has observed targeted attacks on unmitigated NetScaler deployments which can lead to Denial of Service," the company said in a blog post. "If the condition is triggered repeatedly, the service may remain unavailable. Our analysis indicates that this issue affects service availability, and we have not identified an impact on the integrity of customer data." The scores agree. Citrix rates it 8.7 out of 10 under version 4 of the scoring system; NVD, under version 3.1, gives it 7.5, with high impact on availability and none on confidentiality or integrity.

The traffic says the attackers were hoping for more. One administrator, BleepingComputer reported, who went through the logs found crafted login usernames containing shell commands to download a file from a remote address, save it and run it, immediately before three crash sequences. According to SecurityWeek, a user who obtained the script said it tries to plant web shells, survive reboots and upload the appliance's configuration and backups, while cautioning that there was no proof it ran. Kevin Beaumont, the researcher who had named last week's pair "PitScaler", watched patched honeypots crash and then found one running something. "So on one of the honeypots it's running a downloaded (malware) binary. Both were patched, so new vuln," he wrote.

watchTowr, the security firm that reproduced the flaw, has reached a narrower conclusion. It told SecurityWeek that CVE-2026-88779 is a denial-of-service bug that can only crash systems, and that it suspects attackers have used it to crash machines on purpose to make exploitation of CVE-2026-88771, last week's input-validation flaw, faster. The new bug also only affects appliances with SAML configured. "This means it doesn't work out of the box against every NetScaler deployment," Jake Knott, its head of threat intelligence, told CyberScoop. "While this is very inconvenient, it doesn't have organizations scrambling to trigger incident response." Joe Toomey of the cyber insurer Coalition read the same payloads differently: they "clearly contain shellcode that implies that the threat actor believes they can use this vulnerability, or chain it with another vulnerability, in order to achieve remote-code execution."

CISA has not split the difference. The catalogue entry calls it a flaw "that could allow for a denial of service", and then marks it, like last week's two, for forensic triage. Under Binding Operational Directive 26-04 that means an agency has three days to fix the appliance and must also carry out a forensic triage to check whether it has been compromised, for a bug whose vendor says it has found no impact on the integrity of customer data. On the evidence above, that is not excessive. A crash is an event a defender sees; a quiet compromise is not. If watchTowr is right and the crashes are being used to speed up the earlier exploit, then an appliance that rebooted last week is exactly the one that needs looking at.

It also explains why a two-day gap between deadline and attack matters more than the bug's score. The earlier pair were serious: Mandiant found that campaign "ongoing since at least early September", and Palo Alto Networks counted roughly 50,000 potentially exposed NetScaler instances as of 27 September, according to SecurityWeek. Agencies and companies that rushed to install 14.1-73.37 did the right thing, and the attackers moved straight onto the build they had installed.

Citrix handled this round faster, and researchers have said so. It warned customers on Friday and shipped a fix within about two days. "After we were alerted to this issue we immediately developed and published a mitigation while concurrently developing, testing and deploying a fix," a spokesperson said in a statement, CyberScoop reported. The company declined to say how many customers were hit or when exploitation began. Toomey's verdict was mixed: "Although it's difficult to celebrate given this is the third publicly-exploited NetScaler zero-day vulnerability in a two-week window, it is a step in the right direction."

For a security team, the arithmetic is the hard part. Two emergency upgrades of the same edge appliance in a week for three exploited flaws, two forensic checks, two three-day patch deadlines, and a front door that, when attacked, locks out the staff who need to get in. The deadline on Wednesday binds only federal civilian agencies. Everyone else running SAML on a NetScaler is on the same clock, without anyone setting it.