cyber.hendryadrian.com
Vulnerability & Exploit · fieldeffect.com

Citrix Patches Actively Exploited NetScaler SAML Vulnerability

· Original article ↗

Summary

Citrix says attackers are exploiting CVE-2026-88779 in SAML-enabled NetScaler deployments. The flaw can cause authentication-service crashes and outages; affected systems need the October 3 updates.

Key points

  • CISA added CVE-2026-88779 to its Known Exploited Vulnerabilities catalogue after Citrix confirmed targeted attacks on unpatched NetScaler ADC and Gateway deployments.
  • The memory overflow affects NetScaler appliances configured with SAML service-provider or identity-provider profiles.
  • Remote exploitation requires no authentication or user interaction and can trigger nsaaad crashes, appliance reboots, and denial of service.
  • Citrix released fixes on October 3, 2026; earlier September 27 updates for other NetScaler vulnerabilities do not fix this issue.
  • Upgrade to the listed fixed builds: 14.1-73.41 or later, 13.1-64.28 or later, 14.1-73.41 FIPS or later, or 13.1-37.282 FIPS/NDcPP or later.
  • Check for add authentication samlAction and add authentication samlIdPProfile configurations, and monitor authentication logs, nsaaad crashes, Pitboss restarts, unexpected reboots, and repeated SAML requests.

Article Details

Vulnerability Types
  • Memory overflow in SAML authentication processing
Severity
CVSS v4 8.7 (assigned by Citrix)
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

CVE

CVE-2026-88771The disclosure came less than a week after Citrix patched two actively exploited NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772.CVE-2026-88772The disclosure came less than a week after Citrix patched two actively exploited NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772.CVE-2026-88779Citrix disclosed CVE-2026-88779 after observing active exploitation against NetScaler deployments.

Vendors

CitrixCitrix disclosed CVE-2026-88779 after observing active exploitation against NetScaler deployments.

Products

NetScaler ADCVulnerabilities (KEV) catalogue after Citrix confirmed targeted attacks against unpatched Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway deployments.NetScaler Gatewayconfirmed targeted attacks against unpatched Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway deployments.

Related Articles