Citrix
US virtualisation and networking software brand, owned by Cloud Software Group, that makes NetScaler.
Citrix rebuilt its NetScaler fixes on 4 October 2026, a week after admitting two appliance flaws were exploited before any patch existed, because a third SAML-path flaw had also turned up in attacks.
Last refreshed: 12 October 2026 · Appears in 1 active topic
Why does NetScaler keep falling to zero-day attacks in 2026?
Timeline for Citrix
Disclosed three exploited NetScaler flaws and reissued fixed builds
Cybersecurity: Threats and Defences: Citrix replaces its own NetScaler fixJPCERT alerts on NetScaler after watchTowr proof
Cybersecurity: Threats and DefencesMentioned in: Ivanti EPMM logs fourth KEV zero-day since 2023
Cybersecurity: Threats and DefencesMentioned in: Trump proposes $707m CISA cut, 860 jobs
Cybersecurity: Threats and DefencesDisclosed CVE-2026-3055 unauthenticated memory overread in NetScaler ADC and Gateway SAML IdP path
Cybersecurity: Threats and Defences: CitrixBleed 3 lands on SAML brokerBackground
Citrix is a business unit of Cloud Software Group, the software group run by chief executive Tom Krause that also owns TIBCO. Its NetScaler ADC and NetScaler Gateway appliances sit at the network edge and often act as the SAML broker for single sign-on, so a flaw in one can expose every login behind it.
NetScaler's 2026 run of serious bugs opened on 23 March with CVE-2026-3055, a 9.3-rated memory overread researchers dubbed CitrixBleed 3, which attackers exploited within days; CISA set a 2 April federal deadline and the NCSC issued a parallel advisory on 25 March. On 14 August WatchTowr Labs published a working pre-authentication exploit for CVE-2026-8452 on SAML-configured appliances, and Cloud Software Group offered no workaround beyond fixed versions.
Citrix disclosed CVE-2026-107406, another SAML-path memory overflow, on 9 October, reporting no known exploitation at publication; fixed builds start at 14.1-73.46 and 13.1-64.29. CISA counts 27 exploited Citrix flaws on its catalogue since November 2021, seven of them used by ransomware crews. NetScaler customers now face an architecture question as much as a patching one: whether a single appliance should front the whole login chain.
Citrix ships fixes for its fixes
On 27 September 2026 Citrix confirmed that CVE-2026-88771 and CVE-2026-88772 in NetScaler ADC and Gateway had been used before a fix existed, and CISA added both to its exploited list that day with a three-day federal deadline. Rapid7 dated the first attempt to 20 September and found one payload copying the appliance's configuration, TLS private keys and LDAP and RADIUS bind passwords included, to a public web path.
Citrix then disclosed CVE-2026-88779, a memory overflow on SAML-configured boxes also exploited ahead of disclosure, and on 4 October withdrew its September builds for 14.1-73.41 and 13.1-64.28. Britain's NCSC told UK organisations to mitigate on 28 September. Patching does not undo the theft: customers whose configuration leaked still have to rotate every copied key and password.
Citrix ships fixes for its fixes
Why do NetScaler vulnerabilities matter so much?
Is Citrix NetScaler being exploited in 2026?
How does CitrixBleed compare to the cPanel zero-day in terms of vendor response?
Reference
Who owns Citrix?
What is CitrixBleed and why does it keep happening?
What is the newest NetScaler vulnerability?
Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 12 October 2026. Editorial standards.