Affected Systems

Citrix NetScaler ADC and NetScaler Gateway appliances with SAML authentication enabled (Gateway or AAA functionality). Vulnerable versions include all releases prior to 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, and 13.1-37.282 (NDcPP/FIPS). Appliances configured as SAML SP (authentication samlAction) or SAML IdP (authentication samlIdPProfile) are at risk.

Exploitation Status

Active exploitation confirmed. CISA added CVE-2026-88779 to KEV catalog. Citrix observed targeted attacks causing denial-of-service. Multiple NetScaler administrators and researchers (including Kevin Beaumont and watchTowr Labs) report evidence suggesting remote code execution capability beyond confirmed DoS impact. Logs show crafted SAML authentication requests with embedded shell commands downloading payloads from 213.209.159[.]55. Exploitation attempts observed against patched 14.1-73.37 appliances prior to emergency patch release.

Business Impact

NetScaler appliances are critical infrastructure for remote access and application delivery. Confirmed DoS attacks cause service unavailability; repeated exploitation keeps services offline. Suspected RCE capability would allow full appliance compromise, enabling attacker persistence, credential theft, and lateral movement into internal networks. Organizations recently patched for CVE-2026-88771 through CVE-2026-88778 must patch again. Widespread scanning and exploitation activity observed, indicating mass targeting beyond initial focused attacks.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately upgrade NetScaler ADC and Gateway to patched versions: 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, or 13.1-37.282 (NDcPP/FIPS) depending on deployment branch.
  • Verify SAML authentication configuration using commands 'show authentication samlAction' and 'show authentication samlIdPProfile' to confirm exposure.
  • Apply Citrix-provided Global Deny Lists to block known malicious IP addresses, including 213.209.159[.]55, while patching is in progress.
  • Review NetScaler logs for nsaaad crashes, Pitboss restart sequences, and authentication requests with unusual usernames or embedded shell commands since October 3, 2026.
  • Monitor for unexpected appliance reboots or service disruptions on SAML-enabled NetScaler devices and isolate affected systems if compromise is suspected.