Citrix NetScaler SAML Zero-Day CVE-2026-88779 Added to KEV

Citrix NetScaler CVE-2026-88779 is a CISA KEV zero-day under active attack

The big one today is Citrix NetScaler. CISA added CVE-2026-88779 to the Known Exploited Vulnerabilities catalog on October 4. It is a memory buffer flaw in NetScaler, CVSS 7.5, and Citrix shipped a patch on October 4 as well. This is a SAML zero-day that attackers are already using to crash appliances, so treat it as patch now, not patch eventually.

The ugly wrinkle, flagged by SecurityWeek, is that exploitation hit appliances that had been patched only days earlier. That means applying the fix is necessary but may not be sufficient. Check for signs of compromise, review SAML configuration, and rotate anything that could have been exposed on an internet-facing gateway. CISA, BleepingComputer, and Help Net Security all confirmed the active exploitation and the crash behavior.

Note this is separate from CVE-2026-88771, another critical NetScaler ADC flaw (CVSS 9.8) already on KEV. If you run NetScaler, confirm you are clear on both.

Other KEV and hot-mover activity since October 3

Beyond NetScaler, CISA added two Zammad vulnerabilities, CVE-2026-102489 and CVE-2026-102490, after active exploitation. A separate writeup describes a Zammad zero-day chain that lets an AI agent hijack sessions, execute code, and escalate to root, so prioritize Zammad if it is in your stack.

The exploited-CVE leaderboard is dominated by ransomware-linked, KEV-listed items worth confirming you have closed: JetBrains TeamCity CVE-2026-63077 (CVSS 9.8) and CVE-2024-27199, WebPros cPanel and WHM CVE-2026-41940 (CVSS 9.8), Palo Alto PAN-OS CVE-2026-0257, ConnectWise ScreenConnect CVE-2024-1708, Meta React Server Components CVE-2025-55182 (CVSS 10), and Oracle E-Business Suite CVE-2025-61882. SecurityWeek also reports in-the-wild exploitation of a Rejetto HFS flaw, CVE-2026-61500, that was discovered by AI.

Exchange out-of-band fix and a Windows update that breaks things

Microsoft shipped an out-of-band Exchange Server update to fix a high-severity mailbox access bug, CVE-2026-96940, per Help Net Security. This follows Microsoft reissuing an Exchange V2 update after finding a new security flaw. If you run on-premises Exchange, plan this one in.

On the desktop side, watch out for KB5124010. Both BleepingComputer and Cyber Security News report it crashes some games, media players, and productivity apps. If you are staging this, hold it in a ring and validate before broad deployment.

This month's Windows cumulative updates carry heavy CVE loads flagged as Critical with KEV content: KB5046616 for Windows Server 2022 (34 CVEs), KB5046617 for Windows 11 24H2 ARM64 (33), and KB5046615 and KB5046612 on Windows 10 (28 and 25).

Do this first

Short, ordered list grounded in today's facts:

• Patch Citrix NetScaler for CVE-2026-88779 now, then hunt for compromise even on recently patched appliances.
• Confirm NetScaler CVE-2026-88771 and the Zammad CVEs (CVE-2026-102489, CVE-2026-102490) are addressed.
• Apply the out-of-band Exchange update for CVE-2026-96940.
• Stage, do not rush, KB5124010 given the reported app and game crashes.
• Verify the ransomware-linked KEV movers above are closed in your estate: TeamCity, cPanel, PAN-OS, ScreenConnect, React Server Components, and Oracle EBS.
• Use Senserva's free Microsoft Patch Tracker to rank your open Microsoft patches by KEV, EPSS, and ransomware linkage, and the non-Microsoft exploited-CVE tracker to follow KEV additions like the NetScaler flaw against your own environment.

Sources

• Cyber Security News: Citrix NetScaler SAML 0-Day Vulnerability Actively Exploited in Attacks (2026-10-05)
• Cyber Security News: CISA Warns of Citrix NetScaler Vulnerability Actively Exploited in Attacks (2026-10-05)
• SecurityWeek: Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier (2026-10-05)
• Help Net Security: CISA flags new exploited NetScaler flaw as attackers crash appliances (CVE-2026-88779) (2026-10-05)
• BleepingComputer: Citrix patches NetScaler SAML zero-day exploited in attacks (2026-10-04)
• Cyber Security News: CISA Warns of Zammad DIVD Vulnerabilities Actively Exploited in Attacks (2026-10-05)
• Cyber Security News: Zammad Zero-Day Chain Lets AI Agent Hijack Sessions, Execute Code and Escalate to Root (2026-10-05)
• SecurityWeek: Exploitation Hits Rejetto HFS Vulnerability Discovered by AI (2026-10-05)
• Help Net Security: Out-of-band Exchange Server update fixes high-severity mailbox access bug (CVE-2026-96940) (2026-10-05)
• BleepingComputer: Microsoft: Windows KB5124010 update crashes some games and apps (2026-10-05)
• Cyber Security News: Windows 11 KB5124010 Update Crashes Productivity Apps, Games and Media Players (2026-10-05)
• CISA Cybersecurity Advisories: CISA Adds One Known Exploited Vulnerability to Catalog (2026-10-04)

Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-10-05.

Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.