Citrix has confirmed targeted attacks against unmitigated NetScaler deployments affected by CVE-2026-88779, a newly disclosed memory-overflow vulnerability tied to certain SAML authentication configurations. The company released fixed builds and urged customers running affected customer-managed NetScaler ADC and NetScaler Gateway systems to upgrade as soon as possible.
What happened
Citrix disclosed CVE-2026-88779 on October 3, 2026, after tracking a newly observed issue involving SAML authentication on customer-managed NetScaler deployments. The flaw can cause denial of service under specific configuration conditions. Citrix said repeated triggering may keep an affected service unavailable.
The vulnerability carries a CVSS v4.0 score of 8.7. Citrix has observed targeted attacks against systems that had not been mitigated.
This is a separate issue from CVE-2026-88771 and CVE-2026-88772, the two NetScaler remote-code-execution zero-days disclosed in late September. Organizations that already installed the earlier fixed builds may need to upgrade again if their systems meet the CVE-2026-88779 preconditions.
What is confirmed
Citrix confirmed that CVE-2026-88779 is a memory-overflow vulnerability affecting service availability. The company has observed targeted attacks on unmitigated deployments and has released updated software containing the fix.
The Australian Signals Directorate’s Australian Cyber Security Centre also updated its NetScaler alert on October 3. The agency said it is aware of impacts to Australian organizations and warned that remote exploitation may cause system crashes, denial of service, and potential exploitation.
Citrix said its analysis has not identified an impact on the integrity of customer data. That statement does not establish that every affected organization is free from compromise, but it means Citrix has not reported evidence that this flaw alters customer data.
What remains unknown
Citrix has not publicly identified the attackers, the number of targeted organizations, or the full timeline of exploitation. The company has also not reported that CVE-2026-88779 enables data theft or remote code execution.
Businesses should not treat an outage or authentication failure as proof of exploitation. Service disruption can have many causes, and affected organizations should preserve logs and follow their incident-response process before drawing conclusions.
Who is affected
The issue applies to customer-managed NetScaler ADC and NetScaler Gateway deployments when SAML authentication is used with Gateway or AAA functionality. Citrix says administrators should inspect configurations for either of these entries:
add authentication samlActionadd authentication samlIdPProfile
The following supported versions are affected when the required configuration is present:
- NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.41
- NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.28
- NetScaler ADC 14.1-FIPS before 14.1-73.41 FIPS
- NetScaler ADC 13.1-FIPS and 13.1-NDcPP before 13.1-37.282
Citrix-managed cloud services, including Gateway Service and Citrix-managed Adaptive Authentication, are not the customer’s patching responsibility. Citrix said it has applied the required updates to those services.
Why CVE-2026-88779 matters to businesses
NetScaler Gateway commonly provides remote access to internal applications. A denial-of-service attack against that entry point can interrupt employee access, customer-facing services, and business workflows even when underlying systems remain operational.
The new disclosure also creates patch-management complexity. Some organizations may have upgraded recently for the earlier NetScaler vulnerabilities and assume the work is complete. Citrix specifically advises deployments that meet the new SAML preconditions to install the newer CVE-2026-88779 fixed builds.
Practical defensive actions
Identify exposed NetScaler systems
Inventory every customer-managed NetScaler ADC and NetScaler Gateway appliance, including disaster-recovery and standby systems. Confirm the installed build and determine whether the configuration contains a SAML service-provider action or SAML identity-provider profile.
Install the fixed build
Upgrade NetScaler 14.1 systems to 14.1-73.41 or later and NetScaler 13.1 systems to 13.1-64.28 or later. FIPS and NDcPP deployments should use the corresponding fixed builds listed in the Citrix bulletin. Test changes according to the organization’s normal change-control process, but prioritize the work because targeted attacks are confirmed.
Verify temporary virtual patching
Citrix has released Global Deny List signatures that can reduce exposure while administrators validate applicability and plan the upgrade. This mitigation has version and NetScaler Console prerequisites, and it is not a substitute for installing a fixed build. Administrators should follow Citrix’s instructions to confirm that virtual patching is enabled and that the required signature version is present.
Review logs and availability events
Look for unusual SAML authentication activity, repeated appliance crashes, abrupt service restarts, unexplained availability problems, and traffic from suspicious sources. Preserve relevant logs outside the appliance when possible so evidence remains available if the system becomes unstable.
Prepare a remote-access fallback
Document how essential staff will access critical systems if the primary gateway becomes unavailable. Validate emergency contact methods, alternate access procedures, and the approval process for activating a fallback. Do not weaken authentication controls simply to restore access quickly.
Contact support and activate incident response when needed
Organizations experiencing symptoms should contact Citrix support and begin their standard incident-response process. If exploitation is suspected, preserve evidence, isolate affected systems when operationally safe, and engage qualified incident responders before rebuilding or wiping appliances.
What to watch next
Citrix may update the security bulletin as investigations continue. The most important future details will include additional exploitation scope, indicators of compromise, and any changes to affected versions or mitigations.
Organizations should rely on the official Citrix bulletin as the controlling source for fixed builds and technical requirements.
Sources
Citrix security bulletin CTX697174 for CVE-2026-88779