Patch Citrix NetScaler again: a SAML flaw is being exploited, even if you patched last week

If you patched your NetScaler after last week’s alert, you are not finished. Citrix published a separate security bulletin on October 3, 2026 for a new flaw, CVE-2026-88779, and CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on October 4, 2026. Federal agencies have until October 7 to deal with it.

This one is a different bug in a different feature, so the September builds do not fix it.

What’s affected

CVE-2026-88779 is a memory overflow in NetScaler ADC and NetScaler Gateway when the appliance is set up for SAML authentication, either as a SAML service provider (SP, the side that accepts logins from an outside identity provider) or as a SAML identity provider (IdP, the side that vouches for users). Citrix rates it 8.7 on the CVSS v4.0 scale, with no sign-in needed to attack it.

Citrix describes the effect as denial of service, meaning the appliance crashes or stops answering. Outside researchers have reported signs that attackers may be able to do more than crash it. That is unconfirmed in Citrix’s own bulletin, so treat a crash as a warning sign, not just a nuisance.

Affected builds:

• NetScaler ADC and Gateway 14.1 before 14.1-73.41
• NetScaler ADC and Gateway 13.1 before 13.1-64.28
• NetScaler ADC 14.1-FIPS before 14.1-73.41 FIPS
• NetScaler ADC 13.1-FIPS and 13.1-NDcPP before 13.1-37.282

Citrix-managed cloud services have already been patched by Citrix. This alert is about appliances and virtual instances you manage yourself.

Check whether you use SAML

Search your NetScaler running configuration for either of these lines:

add authentication samlAction
add authentication samlIdPProfile

The first means the appliance acts as a SAML service provider. The second means it acts as an identity provider. If you find either, you are in the affected group. If you find neither, this particular flaw does not apply to your configuration, but the September flaws still do if you haven’t fixed them.

What to do

1. Update to a fixed build, or a later release in the same branch:

Branch	Fixed in
NetScaler ADC and Gateway 14.1	14.1-73.41 and later
NetScaler ADC and Gateway 13.1	13.1-64.28 and later
NetScaler ADC 14.1-FIPS	14.1-73.41 FIPS and later
NetScaler ADC 13.1-FIPS and 13.1-NDcPP	13.1-37.282 and later

Citrix’s bulletin lists no workaround or interim mitigation. Upgrading is the fix. If you’re on a branch older than these, plan the move to a supported one now.

2. Look for trouble. Review your logs for unexplained appliance crashes or restarts, and for odd-looking usernames in SAML sign-in attempts, since they have been reported as a sign of probing. Attackers have been seen putting commands in the username field. If you find a crash that lines up with strange sign-in attempts, treat the device as possibly compromised and bring in incident responders. See what to do in the first hour.

3. Keep logs off the appliance. Forwarding NetScaler logs to a separate logging system means the evidence survives if the device is tampered with.

Dates and details here are as of October 4, 2026. Exploitation is confirmed by CISA’s KEV listing. Reports of remote code execution come from outside researchers, not Citrix’s bulletin, and may change as more is learned.

For office managers

If your office signs in to work through a “Citrix Gateway” or “NetScaler” page, and that sign-in hands off to a Microsoft or other company login screen, send this to whoever manages your IT and ask them to confirm the newest update is installed. Last week’s update is not enough.

Sources

• NetScaler ADC and Gateway security bulletin for CVE-2026-88779 (Citrix): affected SAML configurations, CVSS score, affected and fixed builds, no workaround, October 3 publication
• Known Exploited Vulnerabilities catalog (CISA): CVE-2026-88779 added October 4, 2026, due October 7
• Citrix patches NetScaler SAML zero-day exploited in attacks (BleepingComputer): secondary coverage used for outside researchers’ reports of attacker behavior