A new Citrix NetScaler zero-day has moved quickly from discovery to active exploitation. CVE-2026-88779 affects NetScaler ADC and NetScaler Gateway deployments using SAML authentication and can cause the appliance to crash or become unavailable.
The vulnerability carries a CVSS v4 score of 8.7 (High), and Citrix has confirmed targeted attacks against unmitigated deployments. CISA has also added it to the Known Exploited Vulnerabilities (KEV) catalog.
Executive Summary
CVE-2026-88779 is a memory overflow vulnerability that can lead to Denial of Service.
The vulnerability is not present in every NetScaler deployment. The appliance must be configured as either a:
- SAML Service Provider (SP)
- SAML Identity Provider (IdP)
Administrators can check for:
add authentication samlAction
or
add authentication samlIdPProfile
Citrix says the issue affects service availability and has not identified an impact to the integrity of customer data.
Active Exploitation
This is what makes the vulnerability particularly important.
Citrix has confirmed targeted attacks against unmitigated NetScaler deployments. If the vulnerable condition is repeatedly triggered, the service can remain unavailable.
The activity was observed shortly after organizations had patched earlier NetScaler zero-days. Administrators reported unexpected reboots on appliances that had already been updated, prompting further investigation and the discovery of CVE-2026-88779.
Security researchers, including watchTowr and Bishop Fox, were credited by Citrix for reporting the vulnerability. watchTowr reported that it was able to reproduce the flaw after observing activity against NetScaler honeypots.
Confirmed Impact vs. Investigation
The confirmed vendor impact is Denial of Service.
However, researchers have observed activity that is raising questions about whether the vulnerability could potentially be abused for more than service disruption.
There have been reports of suspicious authentication requests and malicious activity involving NetScaler appliances. Researchers are investigating the possibility of code execution.
Remote Code Execution has not been confirmed by Citrix as the impact of CVE-2026-88779.
Therefore, it is more accurate to describe this as an actively exploited NetScaler SAML zero-day with confirmed DoS impact, rather than calling it an RCE vulnerability.
Affected Versions
The affected supported versions are:
- 14.1 before 14.1-73.41
- 13.1 before 13.1-64.28
- 14.1 FIPS before 14.1-73.41 FIPS
- 13.1 FIPS/NDcPP before 13.1-37.282
Secure Private Access Hybrid deployments using affected NetScaler instances are also impacted.
Patch Available
Citrix has released fixes:
14.1: 14.1-73.41 or later
13.1: 13.1-64.28 or later
14.1 FIPS: 14.1-73.41 FIPS or later
13.1 FIPS/NDcPP: 13.1-37.282 or later
One important point for organizations that already patched the previous NetScaler zero-days: the September fixes are not sufficient for CVE-2026-88779. SAML-enabled deployments require the newer October builds.
What Security Teams Should Do
Organizations running NetScaler should:
- Identify all Internet-facing NetScaler ADC and Gateway appliances.
- Check whether SAML SP or IdP functionality is enabled.
- Upgrade to the latest fixed build immediately.
- Review logs for unexpected crashes, reboots and unusual SAML authentication requests.
- Investigate suspicious activity before assuming that patching alone resolves the incident.
- Preserve relevant logs and forensic evidence if compromise is suspected.
Citrix also provides Global Deny List protections for certain deployments, but these should be treated as an interim control rather than a replacement for patching.
Why This Matters
CVE-2026-88779 is another reminder that CVSS alone should not determine vulnerability priority.
An 8.7 vulnerability affecting an internal system is very different from an 8.7 vulnerability affecting an Internet-facing authentication gateway that is already being exploited.
The risk here comes from the combination:
Internet Exposure + SAML Authentication + Active Exploitation + Available Patch
There is also a broader concern: CVE-2026-88779 follows the recently exploited CVE-2026-88771 and CVE-2026-88772 NetScaler vulnerabilities. Organizations that recently patched their appliances should therefore revalidate their current build and configuration, rather than assuming the previous remediation covered this issue.
Final Takeaway
CVE-2026-88779 should be treated as an immediate remediation priority for organizations running SAML-enabled NetScaler ADC or Gateway.
The confirmed impact is Denial of Service, but the active exploitation and ongoing researcher investigation make this more than a routine patching exercise.
Identify. Patch. Investigate.
Do not wait for the next maintenance cycle.
