Citrix discloses third actively exploited NetScaler zero-day in less than a week

Researchers disclosed CVE-2026-88779, an actively exploited zero-day in Citrix NetScaler that causes denial-of-service on SAML-enabled appliances; Citrix issued mitigations and a patch quickly and CISA added the defect to its known exploited vulnerabilities catalogue. While the immediate impact is limited to SAML-enabled deployments and described as lower severity than prior NetScaler zero-days, exploitation is occurring in the wild and observed shellcode indicates attackers may attempt to chain this DoS flaw with another recent NetScaler zero-day (CVE-2026-88771) to achieve remote code execution.