- Published on
New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline
- Authors
- Name
- DeepHorus
Citrix has released fixes for CVE-2026-88779, a high-severity memory overflow vulnerability in NetScaler ADC and Citrix NetScaler Gateway that is already being exploited in targeted attacks. The flaw has a CVSS score of 8.7 out of 10 and can cause denial of service under specific deployment conditions. Citrix says customer-managed deployments are affected.
Exploitation requires an affected system to operate as a SAML service provider or identity provider, typically alongside Gateway or AAA functionality. Administrators can check exposure by searching configurations for add authentication samlAction or add authentication samlIdPProfile. Meeting that role, however, does not by itself mean a deployment has been compromised.
Fixed releases include NetScaler ADC and NetScaler Gateway 14.1-73.41 and later, and 13.1-64.28 and later on the 13.1 branch. Citrix also issued 14.1-FIPS 14.1-73.41 and later, plus 13.1-FIPS and 13.1-NDcPP 13.1-37.282 and later. Organizations should select the update matching their exact platform and deployment model.
Citrix said repeated triggering can keep the NetScaler service unavailable, potentially interrupting remote access, application delivery and SAML-based authentication. The vendor’s analysis identifies an availability impact but says it has found no impact on customer-data integrity. Even without data corruption, a sustained outage can halt business operations and obstruct access controls.
The Citrix Cloud Software Group credited Bishop Fox and watchTowr for reporting the vulnerability. WatchTowr said on X that it reproduced the flaw within hours of detecting NetScaler honeypot activity. Citrix also acknowledged targeted attacks on unmitigated systems, combining its warning with independent technical reporting.
NetScaler operators should promptly inventory SAML roles, review internet-facing exposure and install the applicable fixed release. The risk is especially significant for appliances supporting broad remote-access or application-delivery services, where an outage can affect many users simultaneously. CISA added CVE-2026-88779 to its Known Exploited Vulnerabilities catalog.
Federal civilian agencies covered by the KEV catalog must apply the patches by October 7, 2026. Customers should also verify configuration preconditions, validate the installed build and monitor for disruption or compromise. Citrix may continue assessing the attacks, while defenders watch for repeated exploitation attempts against systems that remain exposed.
The disclosure follows separate reports that CVE-2026-88771 and CVE-2026-88772 were exploited to plant web shells and tunneling tools on compromised systems. Together, the incidents highlight why edge devices remain attractive targets: they mediate trusted access and can serve as privileged routes into enterprise services. The immediate priority is rapid patching, configuration-specific checks and coordinated monitoring across NetScaler estates.
