Attackers are knocking Citrix NetScaler ADC and NetScaler Gateway appliances offline by exploiting a
new flaw in their single sign-on (Security Assertion Markup Language, SAML) login feature. Only
appliances that use SAML sign-in for remote access or authentication are exposed, and those patched
last week for earlier NetScaler flaws still need this new update. Check whether your appliances use
SAML and upgrade them to Citrix’s fixed versions now
1. Vulnerability Details
CVE ID: CVE-2026-88779
CVSS SCORE: 8.7 (CVSS v4.0) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EXPLOIT STATUS: Targeted attacks observed on unmitigated deployments
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer. An unauthenticated remote attacker
can trigger a memory overflow that causes denial of service; repeated triggering can keep the service unavailable. Citrix
found no impact on data integrity. Only appliances configured as a SAML SP (add authentication samlAction) or SAML
IdP (add authentication samlIdPProfile) on Gateway or AAA virtual servers are exposed. Builds fixed under CTX697096
(14.1-73.37, 13.1-64.23) remain vulnerable.
2. Affected Products & Fixed Versions
| COMPONENT | VULNERABLE VERSIONS | FIXED BUILD |
| NetScaler ADC and NetScaler Gateway 14.1 | Before 14.1-73.41 | 14.1-73.41 and later |
| NetScaler ADC and NetScaler Gateway 13.1 | Before 13.1-64.28 | Before 13.1-64.28 |
| NetScaler ADC 14.1-FIPS | Before 14.1-73.41 FIPS | 14.1-73.41 FIPS and later |
| NetScaler ADC 13.1-FIPS and 13.1-NDcPP | Before 13.1-37.282 | 13.1-37.282 and later |
| Secure Private Access Hybrid (NetScaler instances) | Customer-managed NetScaler on affected builds | Upgrade the NetScaler instances; Citrix-managed cloud services are upgraded by Citrix |
3. Observed Activity
- 2 October 2026: NetScaler Cyber Threat Intelligence warned of a newly observed SAML authentication issue in customer-managed Gateway and AAA deployments, independent of the CTX697096 vulnerabilities.
- 3 October 2026: Citrix published bulletin CTX697174 with fixed builds, confirming targeted denial-of-service attacks on unmitigated deployments. No threat actor has been named; Citrix credited Bishop Fox and watchTowr.
- Interim mitigation: Citrix released Global Deny List signatures (v24 or later) via NetScaler Console with Virtual patching enabled, for builds 14.1-73.37 to before 14.1-73.41 and 13.1-64.23 to before 13.1-64.28.
4. Recommendations
- Search every NetScaler configuration, including FIPS, NDcPP, and Secure Private Access Hybrid instances, for add authentication samlAction or add authentication samlIdPProfile on Gateway or AAA virtual servers.
- 2 Upgrade affected appliances to 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, or 13.1-37.282 FIPS/NDcPP or later, even if they were just upgraded for CTX697096.
- Until upgraded, enable Virtual patching in NetScaler Console, confirm signatures are v24 or later with show appfw signatures, and check rule hits with stat denylist global AAA_REQUEST.
- Block attacking source IP addresses with the NetScaler blocklist and perimeter firewall rules, and contact Citrix Support if appliances are already experiencing outages.
5. Sources
- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174
- https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/
- https://community.citrix.com/techzone-blogs/110_security-updates/security-update-guidance-for-netscaler-saml-authentication-deployments/
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.