VULNpocalypse
CriticalVulnerabilityPatch available

Citrix NetScaler CVE-2026-88779: exploited SAML memory overflow DoS, a week after the CVE-2026-88771 and -88772 RCE zero-days

An exploited memory overflow crashes NetScaler ADC and Gateway set up for SAML. Update to 14.1-73.41 or 13.1-64.28, which also fix September’s exploited RCEs.

Published
Updated
Fixed in
NetScaler ADC and Gateway 14.1-73.41, 13.1-64.28; ADC 14.1-73.41 FIPS; ADC 13.1-37.282 FIPS and NDcPP
Exploitation
Yes. CVE-2026-88779 in CISA KEV since 4 October 2026; CVE-2026-88771 and CVE-2026-88772 exploited per Citrix and in KEV since 27 September 2026

Live scores

CVE-2026-88779
EPSS
0.114
likely to be attacked soon
VEDAS
0.536
some exploit evidence
On CISA KEV
Yes, since 2026-10-04
Detection rule
None yet
EPSS (chance of attack)
100.1CVE-2026-88779 EPSS over time2026-102026-11-01
VEDAS (exploit evidence)
100.9CVE-2026-88779 VEDAS over time2026-102026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

Live scores

CVE-2026-88771
EPSS
0.822
very likely to be attacked soon
VEDAS
0.979
strong exploit evidence
On CISA KEV
Yes, since 2026-09-27
Detection rule
Nuclei · Suricata
EPSS (chance of attack)
100.1CVE-2026-88771 EPSS over time2026-102026-11-01
VEDAS (exploit evidence)
100.9CVE-2026-88771 VEDAS over time2026-102026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

Live scores

CVE-2026-88772
EPSS
0.782
very likely to be attacked soon
VEDAS
0.978
strong exploit evidence
On CISA KEV
Yes, since 2026-09-27
Detection rule
Nuclei · Suricata
EPSS (chance of attack)
100.1CVE-2026-88772 EPSS over time2026-102026-11-01
VEDAS (exploit evidence)
100.9CVE-2026-88772 VEDAS over time2026-102026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

What happened

3 October 2026: CVE-2026-88779. Citrix published bulletin CTX697174 for a memory overflow that leads to denial of service, rated CVSS 4.0 8.7. It only applies when the appliance is a SAML service provider or a SAML identity provider (Citrix CTX697174). Citrix warned of “targeted attacks” and said customer data integrity was not affected. Until customers can upgrade, it released signatures for the NetScaler Global Deny List feature (Infosecurity Magazine). CISA added it to KEV on 4 October, with a due date of 7 October (CISA KEV). Citrix credits JPMorgan Chase, Bishop Fox and watchTowr.

27 September 2026: CVE-2026-88771 and CVE-2026-88772. One week earlier, Citrix fixed eight NetScaler bugs in CTX697096 and said exploits of two had been “observed” on unmitigated appliances (Citrix CTX697096):

  • CVE-2026-88771 (CVSS 4.0 9.5): improper input validation lets an unauthenticated attacker run commands. Every deployment is affected, including the default configuration.
  • CVE-2026-88772 (CVSS 4.0 9.5): a memory overflow leading to code execution or denial of service when DTLS is enabled. DTLS is on by default on VPN virtual servers.

CISA added both to KEV on 27 September and requires federal agencies to run forensic triage, not just patch (CISA KEV).

Am I affected?

LineVulnerable to CVE-2026-88779Vulnerable to CVE-2026-88771/-88772
ADC and Gateway 14.1before 14.1-73.41before 14.1-73.37
ADC and Gateway 13.1before 13.1-64.28before 13.1-64.23
ADC 14.1 FIPSbefore 14.1-73.41 FIPSbefore 14.1-73.37 FIPS
ADC 13.1 FIPS and NDcPPbefore 13.1-37.282before 13.1-37.279

Sources: CTX697174, CTX697096. Secure Private Access hybrid deployments that use NetScaler instances are affected too. Citrix-managed cloud services and Citrix-managed Adaptive Authentication are upgraded by Citrix.

Check the build and the SAML precondition from the NetScaler CLI:

show ns version
show ns runningConfig | grep -E "add authentication (samlAction|samlIdPProfile)"

Or from the appliance shell:

bash
grep -E 'add authentication (samlAction|samlIdPProfile)' /nsconfig/ns.conf

A match on samlAction means the appliance is a SAML SP; samlIdPProfile means a SAML IdP. Either meets the CVE-2026-88779 precondition (CTX697174).

For CVE-2026-88772, a VPN virtual server is exposed unless DTLS is explicitly off, for example add vpn vserver vpn1 SSL 10.0.0.0 443 -dtls OFF (CTX697096):

bash
# VPN vservers without DTLS explicitly turned off
grep -E '^add vpn vserver' /nsconfig/ns.conf | grep -v -- '-dtls OFF'
# Virtual servers of type DTLS
grep -E '^add (lb|vpn) vserver [^ ]+ DTLS' /nsconfig/ns.conf

Signs of the DoS. Exploitation crashes the appliance. Look for unplanned reboots, failovers or packet engine restarts on SAML-enabled appliances since early October. Packet engine core dumps are written to /var/core/<N>/ with names starting NSPPE- (Citrix CTX694799).

What to do now

  1. Update to 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS or 13.1-37.282. These builds are newer than the September fixes, so they cover all three exploited CVEs.
  2. If you cannot update today, deploy Citrix’s Global Deny List signatures for CVE-2026-88779 (Infosecurity Magazine). They reduce exposure; they do not fix the bug.
  3. Check for compromise if you ran a build older than 14.1-73.37 or 13.1-64.23 at any point after 27 September. CVE-2026-88771 gives an unauthenticated attacker command execution. Citrix published IOCs for the NetScaler console in its blog for CTX697096 (CISA KEV notes). Patching does not remove an attacker who is already in.
  4. If you suspect compromise, follow CTX694799. Preserve evidence (VPX snapshot, support bundle, packet engine core), isolate the appliance, and change every secret stored on it, including LDAP service accounts, RADIUS shared secrets, OAuth tokens, API keys and SNMP communities. Also change the passwords of users who authenticated through its Gateway or AAA virtual servers (Citrix CTX694799).
  5. Fix the TCP setting for CVE-2026-88778, from the same September bulletin: if show ns tcpparam | grep "Enhanced ISN Generation" returns DISABLED, enable it as Citrix’s TCP configuration guide describes (CTX697096).

Sources