Citrix NetScaler CVE-2026-88779 in KEV

CVE-2026-88779 is a memory overflow in NetScaler ADC and Gateway that can take the service down. Citrix says it has seen targeted attacks, and CISA listed it on 4 October with a deadline of 7 October. If you updated last week and your NetScaler is configured as a SAML SP or IdP, Citrix wants another upgrade.

In short

CVE-2026-88779: memory overflow (CWE-119), denial of service, CVSS v4.0 8.7. Customer-managed deployments only.
The precondition per the bulletin: the appliance is configured as a SAML SP or SAML IdP. Sign in the config: add authentication samlAction or add authentication samlIdPProfile.
Fixed versions: 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS and 13.1-37.282. Those who upgraded per the 27 September bulletin, with the same precondition, upgrade again.

Checked on5 October 2026Responsible editorTsvetelin IvanovHow we workMethod · Corrections

You updated NetScaler last week. Good. If SAML runs on it, you are not done.

The facts: on 4 October 2026 CISA added CVE-2026-88779 to the KEV catalog with a federal deadline of 7 October, a forensic triage requirement and ransomware use marked unknown. The flaw is in Citrix NetScaler ADC and NetScaler Gateway: a memory overflow (CWE-119) that under specific conditions leads to denial of service; CVSS v4.0 8.7. In a blog by the NetScaler Cyber Threat Intelligence team, Citrix says it has observed targeted attacks on unmitigated deployments, that if the condition is triggered repeatedly the service may remain unavailable, and that it has not identified an impact on data integrity. Only customer-managed deployments are affected: 14.1 before 14.1-73.41; 13.1 before 13.1-64.28; ADC FIPS before 14.1-73.41 FIPS; ADC FIPS and NDcPP before 13.1-37.282. Per bulletin CTX697174, the precondition is that the appliance is configured as a SAML SP (the line add authentication samlAction in the configuration) or as a SAML IdP (the line add authentication samlIdPProfile); in the blog Citrix ties the issue to SAML authentication together with Gateway or AAA, and names the bulletin as the authoritative statement. Cloud services that Citrix itself manages are updated by the company. As a mitigation Citrix released signatures through the Global Deny List, but recommends upgrading. If you upgraded with the versions from the bulletin for CVE-2026-88771 through CVE-2026-88778 and the preconditions apply to you, Citrix asks for another upgrade, to the versions for this vulnerability.

What goes down here is the service. Citrix has found no impact on the integrity of the data. But NetScaler is the door people use to get into the company from outside, and while it keeps going down, that door stays shut.

First, see whether it concerns you. In the configuration you look for the two lines from the facts. No SAML, and Citrix's precondition is not met. With SAML, the version decides.

When NetScaler goes down, nobody gets into the company from outside.

The Global Deny List signatures are a bridge. They work through NetScaler Console and only in a narrow window: 14.1 from 73.37 to below 73.41, 13.1 from 64.23 to below 64.28. Citrix presents them as help, while you plan the upgrade.

The backstory On 28 September we wrote about the eight holes in the 27 September bulletin, two of them already exploited. The fixes there are 14.1-73.37 and 13.1-64.23. For this hole Citrix wants one more step.

Upgraded to 14.1-73.37 or 13.1-64.23 and the SAML precondition applies to you? The next version is 14.1-73.41 or 13.1-64.28. CISA's deadline runs out on Wednesday.

The visual is generated code art. No third-party images.

A third NetScaler hole lands in KEV within seven days, and if your NetScaler runs SAML, you upgrade again

More on this

CISA puts four actively exploited zero-days into KEV in one day

A Magento flaw rated 10 entered the catalog of exploited vulnerabilities, with three days to patch

Two holes in Check Point and one in Arista are being used in attacks, and part of on-premises Arista has no fix yet