Citrix patches NetScaler SAML zero-day exploited in attacks

Citrix has released emergency security updates addressing a new denial-of-service vulnerability in NetScaler, tracked as CVE-2026-88779. The vulnerability has been actively exploited in zero-day attacks. Researchers are also investigating whether the flaw can be leveraged for remote code execution beyond denial-of-service. The patch was issued on an emergency basis given the active exploitation. Organizations using NetScaler are urged to apply the updates immediately to mitigate risk.