NetScaler CVE-2026-88779 Zero-Day Exploited Against SAML Deployments
NetScaler CVE-2026-88779 Zero-Day Exploited Against SAML Deployments
Citrix has released patches for a CVSS 8.7 memory overflow vulnerability in NetScaler ADC and NetScaler Gateway that is being actively exploited. Only deployments configured as a SAML service provider or SAML identity provider are vulnerable.
Citrix released security updates addressing CVE-2026-88779, a memory overflow vulnerability in NetScaler ADC and Citrix NetScaler Gateway. Successful exploitation can cause denial-of-service. Citrix states that if the condition is triggered repeatedly, the service may remain unavailable. Citrix also states the issue affects service availability and that it has not identified an impact on the integrity of customer data.
Exploitation requires the appliance to be configured as either a SAML SP or SAML IdP. Citrix provides these configuration checks:
- SAML SP: presence of
add authentication samlActionentries - SAML IdP: presence of
add authentication samlIdPProfileentries
Fixed versions:
| Product | Fixed version |
|---|---|
| NetScaler ADC and Gateway | 14.1-73.41 and later |
| NetScaler ADC and Gateway 13.1 | 13.1-64.28 and later |
| NetScaler ADC 14.1-FIPS | 14.1-73.41 FIPS and later |
| NetScaler ADC 13.1-FIPS and 13.1-NDcPP | 13.1-37.282 and later |
Citrix credited Bishop Fox and watchTowr for reporting the vulnerability. watchTowr states it reproduced the flaw within hours of detecting NetScaler honeypot activity. The source also notes active exploitation of two related vulnerabilities, CVE-2026-88771 and CVE-2026-88772, to plant web shells and tunneling tools on compromised systems.
Customer-managed NetScaler ADC and NetScaler Gateway deployments running affected versions and configured as a SAML SP or SAML IdP. Citrix-managed cloud deployments are not mentioned as affected. The source does not state which industries or organization sizes are targeted.
Patches were released on October 5, 2026. CISA has added CVE-2026-88779 to its Known Exploited Vulnerabilities catalog and requires federal agencies to apply patches by October 7, 2026.
- Vulnerability is exploitable only when NetScaler ADC or NetScaler Gateway is configured as a SAML SP or SAML IdP.
- Affects customer-managed deployments only, per the source.
- The source does not state licensing requirements.
- Check your NetScaler configuration for
add authentication samlAction(SAML SP) andadd authentication samlIdPProfile(SAML IdP) entries to confirm whether the precondition for exploitation is met. - If the precondition is met, prioritize patching to the fixed version for your branch (see table above).
- If you are a federal agency, apply patches by October 7, 2026, per CISA KEV requirements.
- Review for indicators of compromise related to CVE-2026-88771 and CVE-2026-88772 as well, the source reports active exploitation of those CVEs to deploy web shells and tunneling tools on NetScaler systems.
- Check whether your detection and response coverage includes NetScaler-based denial-of-service and post-exploitation activity (web shell creation, tunneling tool installation).
My read is that the SAML precondition is a meaningful filter: organizations that do not use NetScaler as a SAML SP or IdP are not exposed to this specific CVE, though the simultaneous exploitation of CVE-2026-88771 and CVE-2026-88772 for web shell and tunneling deployment suggests broader attacker interest in NetScaler infrastructure regardless of SAML configuration.
I would treat this as an emergency patch cycle for any customer-managed NetScaler instance with SAML configured, given confirmed active exploitation, a CISA KEV listing, and a patch window of two days for federal agencies. I would also check for signs of compromise consistent with CVE-2026-88771 and CVE-2026-88772 on all NetScaler systems, not only those with SAML configured.
The source is a The Hacker News article dated October 5, 2026, covering CVE-2026-88779 and referencing related CVEs; it does not include Citrix's full security advisory, detailed indicators of compromise, or mitigation options short of patching.