Affected Systems

Citrix NetScaler ADC and NetScaler Gateway versions prior to 14.1-73.41, 13.1-64.28, 14.1-FIPS 14.1-73.41, and 13.1-FIPS/13.1-NDcPP 13.1-37.282. Only deployments configured as SAML service provider (SP) or SAML identity provider (IdP) are vulnerable.

Exploitation Status

Actively exploited in targeted zero-day attacks. Citrix confirmed targeted attacks on unmitigated deployments. CISA added CVE-2026-88779 to KEV catalog. watchTowr reproduced the flaw within hours of detecting honeypot activity.

Business Impact

Memory overflow vulnerability (CVSS 8.7) causes denial-of-service in SAML-enabled NetScaler deployments. Repeated exploitation can keep services unavailable. Citrix states no impact on data integrity observed. Federal agencies required to patch by October 7, 2026. Organizations using NetScaler for SAML authentication face service disruption risk.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately verify if NetScaler ADC or Gateway is configured as SAML SP (check for 'add authentication samlAction') or SAML IdP (check for 'add authentication samlIdPProfile') in configuration
  • Upgrade affected NetScaler instances to patched versions: 14.1-73.41+, 13.1-64.28+, 14.1-FIPS 14.1-73.41+, or 13.1-FIPS/NDcPP 13.1-37.282+
  • Monitor NetScaler logs for repeated service crashes or denial-of-service patterns targeting SAML endpoints
  • If immediate patching is not possible, consider temporarily disabling SAML functionality or implementing network-level access controls to SAML endpoints
  • Review NetScaler deployments for indicators of compromise related to concurrent CVE-2026-88771 and CVE-2026-88772 exploitation (web shells, tunneling tools)