攻击者持续针对 Citrix NetScaler 设备发起攻击，联邦机构与私营安全研究人员均发出警告：有人发现并已利用了另一个尚未修补的 Citrix 漏洞。该最新漏洞编号为 CVE-2026-88779，属于内存溢出漏洞，可导致拒绝服务攻击。它仅影响配置为 SAML（安全断言标记语言）服务提供商或身份提供商的 NetScaler ADC 与 Gateway 设备，这些设备用于单点登录认证。
The attackers just keep coming after Citrix NetScaler appliances, as both the feds and private security researchers warn that someone found - and has already exploited - yet another Citrix bug before it had a patch. This latest vulnerability, tracked as CVE-2026-88779, is a memory overflow bug that leads to denial of service attacks. It only affects NetScaler ADC and Gateway appliances configured as a SAML (Security Assertion Markup Language) service provider or identity provider, used for single sign-on authentication.
周五晚间，随着利用报告出现，Citrix 确认正在调查“客户自管 NetScaler 部署中新观测到的与 SAML 认证相关的问题”。到周六夜间，厂商发布了针对 NetScaler ADC 与 NetScaler Gateway 的安全公告并提供补丁，敦促受影响客户“尽快安装相关更新版本”。Citrix 还发布博客文章披露该漏洞，确认已观测到针对未缓解的 NetScaler 部署的定向攻击，可导致拒绝服务。
Late Friday, amid exploitation reports, Citrix confirmed that it was investigating a “newly observed issue related to SAML authentication in customer-managed NetScaler deployments.”By Saturday night, the vendor released a security advisory for NetScaler ADC and NetScaler Gateway with patches, urging vulnerable customers to “install the relevant updated versions as soon as possible.”Citrix also posted a blog about the vulnerability, confirming that it has observed targeted attacks on unmitigated NetScaler deployments that can lead to denial of service.
Citrix 未回应我们关于 CVE-2026-88779 的提问——包括受影响实例数量及攻击者利用漏洞后的行为——但敦促客户“迅速应用”针对 NetScaler 实例的修复。“我们最近获悉一个影响部分 NetScaler 部署服务可用性的新问题，”Citrix 发言人告诉 The。“获悉该问题后，我们立即开发并发布了缓解措施，同时并行开发、测试并部署了修复方案。”
Citrix did not answer our questions about CVE-2026-88779 - including how many instances have been affected and what attackers are doing after exploiting the bug - but urged customers to "quickly apply" the fix to NetScaler instances. "We were recently alerted to a new issue that affects service availability for some NetScaler deployments," a Citrix spokesperson told The. "After we were alerted to this issue we immediately developed and published a mitigation while concurrently developing, testing and deploying a fix."
周日，美国网络安全和基础设施安全局（CISA）确认 CVE-2026-88779 正遭活跃利用，并命令联邦机构于周三前完成修补。
On Sunday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed CVE-2026-88779 was under active exploitation and ordered federal agencies to patch the bug by Wednesday.
虽然这个新漏洞在技术上与Citrix于9月27日最终披露的早期八个CVE无关——这距离不法分子开始滥用其中两个安全漏洞（CVE-2026-88772和CVE-2026-88771）已过去数周——但watchTowr的研究人员告诉我们，他们怀疑该漏洞已被用于故意使机器崩溃，从而加快对CVE-2026-88771的利用。“这个漏洞极易触发，只需一个特制的请求即可使设备离线，”watchTowr威胁情报负责人Jake Knott告诉The。
While the new vulnerability is not technically related to the earlier eight CVEs finally disclosed by Citrix on September 27 - weeks after miscreants began abusing two of these security holes (CVE-2026-88772 and CVE-2026-88771) - watchTowr researchers told us they suspect it has been used to purposefully crash machines, making exploitation of CVE-2026-88771 faster. “This vulnerability is incredibly simple to trigger, with a single specially crafted request being all that is needed to knock an appliance offline,” watchTowr’s head of threat intelligence, Jake Knott, told The.
“利用已在野外发生，破坏认证网关会阻止合法用户访问其背后的服务。”watchTowr于周五复现了该漏洞，Citrix将攻击面管理公司watchTowr以及Bishop Fox列为协助其解决该问题的贡献者。“Citrix提供了一个指标脚本，团队可运行它来检查暴露的设备是否有被攻陷的迹象，不过干净的结果并不构成确凿证据，”Knott说。
“Exploitation is already occurring in the wild, and disrupting an authentication gateway can prevent legitimate users from accessing the services behind it.”WatchTowr reproduced the vulnerability on Friday, and Citrix credited the attack-surface management company along with Bishop Fox with helping it address the issue. “Citrix provides an indicator-of-compromise script that teams can run to check exposed appliances for signs of compromise, though a clean result is not definitive proof,” Knott said.
“安全团队应优先关注配置为网关或启用了SAML认证的AAA虚拟服务器的设备，受影响的组织应应用修复版本或Citrix的临时缓解措施（如果无法立即升级）。”®
“Security teams should prioritize appliances configured as a Gateway or AAA virtual server with SAML authentication enabled, and affected organizations should apply the fixed build or Citrix’s interim mitigation if an immediate upgrade is not possible.”®