You're viewing the front-end.social public feed.

Federated feed Local feed

Kevin BeaumontGossiTheDog@cyberplace.social
Oct 4, 2026, 9:55 AM
The new Citrix Netscaler vuln from Friday is CVE-2026-88779, patch is out now and they recommend patching as soon as possible: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174
Although the vuln is labeled “Memory overflow vulnerability leading to Denial of Service”, that’s the same as CVE-2025–6543. You may remember that lead to RCE in the wild. Prior blog on that: https://doublepulsar.com/citrix-forgot-to-tell-you-cve-2025-6543-has-been-used-as-a-zero-day-since-may-2025-d76574e2dd2c
💬 5🔄 7⭐ 4

Replies

Kevin BeaumontGossiTheDog@cyberplace.social
Oct 5, 2026, 10:14 AM
I need @watchTowr to fact-check me here but I think CVE-2026-88779 is a redux of CVE-2026-8452? At least based on this mitigation Citrix support are giving out, somebody posted it on their blog. https://www.deyda.net/index.php/de/2026/08/28/netscaler-cve-checkliste-updates-sicherheitspruefung-und-incident-response/
The 8452 patch locked SAML PrefixList to 512 byte or below string. But I think CVE-2026-88779 may be more than 15 items in PrefixList, space-separated, to trigger a vuln. Assuming Citrix support gave out the right mitigation.
💬 1🔄 1⭐ 1
Kevin BeaumontGossiTheDog@cyberplace.social
Oct 5, 2026, 2:25 PM
Also the mitigations are easy to bypass - /cgi/samlauth isn’t the only endpoint. So patch rather than use the mitigation script.
💬 1🔄 0⭐ 0
Kevin BeaumontGossiTheDog@cyberplace.social
Oct 8, 2026, 4:55 PM
Watchtowr have a good look at pray and spray #PitScaler exploitation. This isn’t the initial exploitation - their timeline should expand back to September 4th for that.
Also they make a good point re the latest SAML bug - by using it to DoS, it causes attacker commands in the logs to process immediately post reboot with PitScaler vuln. Not covered in blog: Attackers are actually doing this, they’re preloading the logs using the username field for failed logins.
https://watchtowr.com/intelligence/post-exploitation-analysis-artifacts-citrix-netscaler-cve-2026-88771/
💬 2🔄 0⭐ 0
faebudofaebudo@ioc.exchange
Oct 4, 2026, 10:21 AM
@GossiTheDog Also their CVSS 4.0 calculation only has VA:H, both VC and VI are None. So either they're lying or they didn't fix all the vulnerabilities used in this attack but only the triggering DoS condition but not the one leading to RCE.
💬 1🔄 0⭐ 0
Darsesdarses@mastodon.nl
Oct 4, 2026, 11:06 AM
@faebudo @GossiTheDog
Is there any proof that CVE-2026-88779 actually has RCE impact? As far as I can tell this is all just conjecture based on the attempted command injection payloads from the same actor that introduced the crashes that lead to this fix.
💬 0🔄 0⭐ 0
VessOnSecuritybontchev@infosec.exchange
Oct 4, 2026, 11:28 AM
@GossiTheDog What resources are the attackers accessing? Not only for this exploit but for Citrix Netscaller exploits in general. I'm running a honeypot for it but it was seen only 3 hits for the past 5 years. It is geared towards a specific exploit, though - it looks only for attackers trying to access /vpn. So, I was wondering if I could expand it to catch the newer exploits, too.
💬 0🔄 0⭐ 0
Joshua Smalljsmall@infosec.exchange
Oct 4, 2026, 11:32 AM
@bontchev @GossiTheDog The write up says this is specific to SAML being enabled, so I suspect there's a saml related endpoint involved.
💬 0🔄 0⭐ 0
*sigh*Ber nardbrnrd@bsd.network
Oct 4, 2026, 12:00 PM
@GossiTheDog someone told me the vulns only affect the self-hosted NetScalers, but the SaaS variant is not affected. Weird... Is that some totally different stack?
On-prem is a horror-show of end-of-life OS, webserver run in the worst way possible. If they've fixed all that in SaaS, why not ship that to customers!
💬 0🔄 0⭐ 0
Will Dormannwdormann@infosec.exchange
Oct 4, 2026, 12:16 PM
@GossiTheDog
There's no way a memory overflow could lead to RCE on a system with no ASLR or stack canaries. 😂
💬 0🔄 1⭐ 1
fuzzyfuzzyfungusfuzzyfuzzyfungus@cyberplace.social
Oct 4, 2026, 2:22 PM
@wdormann @GossiTheDog Anyone know how/why 'ASLR' has managed to avoid becoming one of those mandatory tickbox features where you at least need to do it badly and say you do it to even be taken seriously? The linux half of your jank linux appliance has supported it for 20 years; what's with your half?
💬 0🔄 1⭐ 2
Will Dormannwdormann@infosec.exchange
Oct 4, 2026, 3:32 PM
@fuzzyfuzzyfungus @GossiTheDog
FreeBSD has made it clear that they don't care about / don't understand security.
💬 0🔄 2⭐ 2
tehfishmantehfishman@ioc.exchange
Oct 4, 2026, 6:53 PM
@wdormann @fuzzyfuzzyfungus @GossiTheDog yeah they seem to take the stance that unless a security measure is perfect* it's not worth the time. But FreeBSD does support it anyway, you just have to turn it on. And Citrix choosing to not turn it on in their precompiled, shipped security appliance is what's truly egregious.
* Perfect is undefined
💬 0🔄 1⭐ 0
Will Dormannwdormann@infosec.exchange
Oct 4, 2026, 9:02 PM
@tehfishman @fuzzyfuzzyfungus @GossiTheDog
No. The current NetScaler is based on FreeBSD 11.4, which predates ASLR support by years.
💬 0🔄 1⭐ 1
zuzu_zuzu_@cyberplace.social
Oct 8, 2026, 8:29 PM
@GossiTheDog Another one?
https://www.reddit.com/r/Citrix/comments/1x0w6a1/netscaler_ns141_build_7346nc_date_oct_7_2026/
💬 0🔄 0⭐ 0
CreekCreek__@cyberplace.social
Oct 8, 2026, 9:09 PM
@GossiTheDog https://community.citrix.com/techzone-blogs/110_security-updates/protecting-customers-immediate-guidance-for-cve-2026-107406-in-netscaler-adc-and-netscaler-gateway-r1631/
They did it again :D
💬 0🔄 0⭐ 0