Citrix has patched a new NetScaler vulnerability, CVE-2026-88779, that is being exploited, The Register reports on October 5, 2026. Citrix's own security bulletin (CTX697174) describes the flaw.
What Citrix's bulletin says:
- It is a memory overflow vulnerability that leads to denial of service.
- It only affects NetScaler ADC and NetScaler Gateway configured as a SAML service provider or a SAML identity provider.
- It carries a CVSS v4.0 base score of 8.7.
- Fixed versions: 14.1-73.41 and later, 13.1-64.28 and later of 13.1, 14.1-FIPS 14.1-73.41 and later, and 13.1-FIPS and 13.1-NDcPP 13.1-37.282 and later.
- To check exposure, look in the NetScaler configuration for entries that match "add authentication samlAction" or "add authentication samlIdPProfile."
- Citrix thanks Bishop Fox and watchTowr.
What The Register reports:
- Citrix confirmed late Friday it was investigating a "newly observed issue related to SAML authentication," and released the advisory and patches by Saturday night. Citrix says it has seen targeted attacks on unmitigated deployments that can lead to denial of service.
- CISA confirmed on Sunday that the bug is under active exploitation and ordered federal agencies to patch by Wednesday. We could not open CISA's page directly, so that comes from The Register.
- Citrix did not answer questions about how many appliances were affected or what attackers do after exploiting it.
- watchTowr's Jake Knott said a single crafted request is enough to knock an appliance offline, and that exploitation is happening in the wild. He said the firm suspects attackers have used it to crash machines on purpose, which could speed up exploitation of CVE-2026-88771.
- It is not technically related to the eight earlier CVEs Citrix disclosed on September 27, weeks after attackers began abusing two of them (CVE-2026-88772 and CVE-2026-88771), The Register says.
For admins: Citrix urges customers to install the fixed versions as soon as possible. Knott said Citrix provides an indicator-of-compromise script, but a clean result is not definitive proof, and that appliances using Gateway or AAA virtual servers with SAML should come first.