Citrix has disclosed CVE-2026-88779, a third exploited NetScaler ADC and Gateway flaw in two weeks. This one is a memory overflow that knocks over appliances configured for SAML. Appliances that already took the September 27 patches are still exposed and need the newer builds.
What happened
Citrix (Cloud Software Group) published bulletin CTX697174 on October 3, 2026. CVE-2026-88779 is a memory overflow (CWE-119) that leads to denial of service. It carries a CVSS v4.0 base score of 8.7, with high availability impact and no confidentiality or integrity impact. It is unauthenticated and network-reachable. The bulletin credits Bishop Fox and watchTowr.
Only appliances acting as a SAML service provider or a SAML identity provider are affected. The bulletin identifies these by the configuration entries add authentication samlAction (SP) and add authentication samlIdPProfile (IdP). Secure Private Access hybrid deployments that use an affected NetScaler instance also need the update.
Fixed releases:
- NetScaler ADC and Gateway 14.1-73.41 and later
- NetScaler ADC and Gateway 13.1-64.28 and later
- NetScaler ADC 14.1-FIPS: 14.1-73.41 FIPS and later
- NetScaler ADC 13.1-FIPS and 13.1-NDcPP: 13.1-37.282 and later
The bulletin itself urges customers to upgrade as soon as possible. Exploitation details come from secondary coverage. The Hacker News and Help Net Security both report that Citrix has observed "targeted attacks on unmitigated NetScaler deployments which can lead to Denial of Service." CISA added the CVE to its Known Exploited Vulnerabilities catalog on Sunday, October 4, and gave federal civilian agencies until October 7 to remediate. Help Net Security cites Reddit users reporting NetScaler crashes and reboots after upgrading to patch the earlier batch of vulnerabilities, which included CVE-2026-88771 and CVE-2026-88772. Kevin Beaumont reported attacks on his honeypots from multiple IP addresses and found a downloaded malware binary on one of them. Separately, Help Net Security says attackers appear to be using the flaw to download and run a script that installs webshells, without naming a source for that detail. It also notes that it is unclear whether remote code execution is possible.
Why it matters
This is a separate bug from the one we covered last week in Citrix NetScaler ADC and Gateway: eight CVEs disclosed, two zero-days exploited. That one was about remote code execution. This one is about availability, and the exposure condition is identity-specific. If NetScaler is your SAML SP in front of internal apps, or your IdP for federated sign-in, an attacker who can crash it on demand can take SSO offline for every application behind it.
There is a second risk. The reported follow-on activity (a malware binary on a honeypot, and webshell scripts) suggests, in our reading, that attackers are doing more than crashing boxes. A crash loop on a box you patched last week does not prove compromise, but it does mean you should run the compromise checks again rather than treat the box as clean.
What to check in your environment
- Search every NetScaler ADC and Gateway configuration for
samlActionandsamlIdPProfileentries. Any appliance with either one is in scope, including FIPS, NDcPP and Secure Private Access hybrid instances. - Compare running builds against 14.1-73.41, 13.1-64.28 and 13.1-37.282. Builds 14.1-73.37 and 13.1-64.23 from the September 27 fix are below these thresholds.
- Review appliance uptime, crash and reboot history back to at least late September, including boxes already upgraded for the earlier CVEs. Unexplained restarts on SAML-enabled boxes are worth a look.
- Run Citrix's indicator-of-compromise script again. watchTowr advises reviewing the results carefully and preserving evidence before applying the update. Citrix notes the latest script version can flag suspicious "nobody" processes as a false positive even when there is no compromise.
- Help Net Security reports that Citrix recommends the Global Deny List feature to reduce exposure while you plan the upgrade. Confirm with your NetScaler owner whether that is enabled.
- Tell the IAM and application owners who rely on NetScaler SAML that an outage is possible. Confirm there is a documented break-glass sign-in path if the SP or IdP goes down.