NetScaler zero-day CVE-2026-88779: DoS on SAML deployments

📌 Later developments: NetScaler CVE-2026-107406: SAML IdP at risk even after patching (October 9, 2026) · NetScaler zero-days: WHIPSHOT and SLAPSHOT malware, IoCs to hunt (September 29, 2026)

Citrix has fixed CVE-2026-88779, a NetScaler ADC and NetScaler Gateway vulnerability that was exploited in targeted attacks before a patch existed. The flaw is a memory overflow. When the appliance uses SAML authentication, attackers can exploit it to crash the appliance remotely and cut off access to the services behind it. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 4 October and gave US federal agencies until 7 October to act.

A few days later, on 8 October, Citrix published a second bulletin for CVE-2026-107406. It is another memory overflow in the same SAML configurations, rated critical this time, with possible remote code execution.

What happened

On Friday 2 October, amid reports of exploitation, Citrix confirmed it was investigating an issue related to SAML authentication in customer-managed NetScaler deployments. Over the weekend it released the bulletin with fixed builds and an interim mitigation. The vendor says it has observed targeted attacks against unmitigated deployments that cause denial of service. It also says the integrity of customer data was not affected. The bulletin credits watchTowr and Bishop Fox.

watchTowr reproduced the vulnerability. According to the company, a single specially crafted request is enough to take an appliance offline. Its researchers believe attackers used the flaw to crash appliances on purpose and speed up exploitation of CVE-2026-88771, one of the two code-execution zero-days Citrix fixed on 27 September. This is the researchers’ assessment, and the vendor has not confirmed it.

Technical details

• CVE: CVE-2026-88779, CVSS 8.7. CISA classifies it as improper restriction of operations within the bounds of a memory buffer (CWE-119).
• Affected products and versions:
  • NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.41;
  • NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.28.
• Precondition: the appliance must be configured as a SAML service provider (SP) or identity provider (IdP). The configuration then contains lines such as add authentication samlAction (SP) or add authentication samlIdPProfile (IdP).
• Vector: network. The attacker sends a crafted request to the virtual server (Gateway or AAA) that uses SAML.
• Impact confirmed by Citrix: denial of service. BleepingComputer reports that researchers and admins later said the flaw could also be used for code execution. Citrix’s bulletin, however, only describes DoS.
• MITRE ATT&CK: T1190 (Exploit Public-Facing Application) and T1499.004 (Endpoint Denial of Service: Application or System Exploitation).

CVE-2026-107406 (CVSS 9.5) affects the same products configured as SAML SP or IdP, under specific configuration conditions. It also affects Secure Private Access Hybrid deployments that use NetScaler. The fixed builds are 14.1-73.46, 13.1-64.29 and 14.1-73.46 FIPS, plus 13.1.37.283 for 13.1-FIPS and 13.1-NDcPP. When the bulletin was published, Citrix said it was not aware of any exploitation.

Context

On 27 September Citrix disclosed eight CVEs in ADC and Gateway. Attackers had been exploiting two of them, CVE-2026-88771 and CVE-2026-88772, before patches were available. According to press reports, the attacks targeted government, financial services, education, legal and professional services organisations. The attackers deployed web shells and tunnelling malware, stole credentials, gained root access and moved into internal networks. In August CISA had already added CVE-2026-8452, another memory overflow in the same products, to the KEV catalog.

Shadowserver counts more than 21,000 internet-exposed IP addresses with a NetScaler fingerprint. It is not known how many of them are vulnerable, already patched or honeypots.

Impact for European and Italian companies

NetScaler Gateway is often the entry point for remote work and virtualised applications. When the gateway goes down, everyone who works through it stops too. In healthcare, the gateway can provide remote access to clinical systems, so a DoS also becomes a business continuity problem.

For NIS2 entities, an outage of a critical access service may be an incident that must be assessed for notification to the national CSIRT. In Italy, that is CSIRT Italia at ACN. The run of vulnerabilities on the same appliances also calls for documented vulnerability management with explicit priorities.

What to do now

1. Find the affected appliances: list every NetScaler ADC and Gateway, including the instances used by Secure Private Access Hybrid. Search the configuration for add authentication samlAction and add authentication samlIdPProfile.
2. Upgrade: move at least to the builds in the 8 October bulletin (14.1-73.46, 13.1-64.29 and the matching FIPS and NDcPP builds). They are later than the builds that fix CVE-2026-88779 (14.1-73.41 and 13.1-64.28).
3. If you cannot upgrade right away, apply the signatures Citrix published through the NetScaler Global Deny List feature. This is a temporary measure until you can install the fixed build.
4. Look for signs of compromise: run Citrix’s indicator-of-compromise script. As watchTowr points out, a clean result is not definitive proof. Check appliances configured as Gateway or AAA virtual servers with SAML enabled first.
5. Connect the events: investigate every recent unexpected restart or crash of a NetScaler. Also check that the fixes for CVE-2026-88771 and CVE-2026-88772 are installed, since the DoS may have been used to exploit them.
6. Monitor your exposed surface: check which NetScaler interfaces can be reached from the internet and whether they really need to be.

How ARXDOME helps

ARX Expose shows which services your company exposes on the internet, which products it recognises on them and which have known vulnerabilities. That helps you quickly find the gateways that need updating. ARX Sentry collects logs from network devices in a central collector, so analysts can see anomalies at the perimeter. ARX Horizon lets you look up vulnerabilities and indicators of compromise directly from the portal.

Last updated: 9 October 2026