CVE-2026-88779

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-88779

Citrix · NetScaler · Added 2026-10-04 · Published 2026-10-04

3-Day Required KEV Automatable Active Exploitation

Details

VulnerabilityCitrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

VendorCitrix

ProductNetScaler

Date added2026-10-04

Due date2026-10-07

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-119

Descriptions

KEV: Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.

NVD: Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impactpartial

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days

Non-public timeline14 days

Forensic (public)Not required

Forensic (non-public)Not required

Research metadata

Last researched2026-10-05 00:40 UTC

Wall time0.6s

Searches9

Component defaultno

Sources https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174
https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/
https://www.bleepingcomputer.com/news/security/citrix-patches-netscaler-saml-zero-day-exploited-in-attacks/
https://labs.beazley.security/advisories/BSL-A1216
https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker
https://github.com/orjanj/netscaler_threat_hunt_helper
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88779
https://www.cve.org/CVERecord?id=CVE-2026-88779
https://nvd.nist.gov/vuln/detail/CVE-2026-88779

QC notes

warn component_extraction: Component 'SAML SP/IdP authentication processing in NetScaler AAA - the nsaaad daemon handling `add authentication samlAction` / `add authentication samlIdPProfile` (e.g. /saml/login) on Gateway and AAA virtual servers' matches or contains product name 'NetScaler' — no specific component identified

Hunting hypothesis agent

Hunt NetScaler AAA and Gateway access logs for crafted SAML requests to /saml/login and samlAction endpoints, correlate nsaaad crash lines 'exited on signal' or 'monitored processes have exited' in /var/log/messages before reboots.

Research details

ComponentSAML SP/IdP authentication processing in NetScaler AAA - the nsaaad daemon handling `add authentication samlAction` / `add authentication samlIdPProfile` (e.g. /saml/login) on Gateway and AAA virtual servers

PreconditionsExploitable only on builds before 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS or 13.1-37.282 (FIPS/NDcPP) with SAML configured - `add authentication samlAction` (SP) or `add authentication samlIdPProfile` (IdP) serving a Gateway or AAA virtual server; the attacker needs only unauthenticated network access to the SAML endpoints (CVSS 4.0 AV:N/AC:L/PR:N/UI:N), no credentials. agent

DeliveryUnauthenticated crafted SAML protocol requests to SAML SP/IdP endpoints on internet-facing Gateway/AAA virtual servers

Public PoCno

Advisoryhttps://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174

Exploit notesNo weaponized public PoC found in this cycle; the only public artifacts are defensive, read-only tooling (github.com/ThomasPoppelgaard/netscaler-ctx697096-checker and github.com/orjanj/netscaler_threat_hunt_helper - exposure checkers / IoC scanners, not exploit code). CVSS 4.0 base 8.7 (AV:N/AC:L/PR:N/UI:N, availability only) and exploitation requires SAML SP or IdP to be configured. Citrix reports targeted attacks on unmitigated deployments; Beazley observed actors forcing repeated nsaaad crashes to reboot appliances so the CVE-2026-88771 log injection fires, with no code execution seen on systems patched for those CVEs, and Citrix states no customer-data integrity impact. Interim mitigations: Citrix Global Deny List signatures via NetScaler Console plus the Citrix Support responder policy (rules referencing samlauth/doAuthentication bound -type AAA_REQUEST on every Gateway/AAA vserver); upgrading to the fixed builds supersedes them.

SummaryCitrix NetScaler ADC and Gateway carry a memory buffer overflow (CWE-119, CVSS 4.0 8.7) in the SAML authentication subsystem, fixed in 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS and 13.1-37.282. An appliance is exposed only when configured as a SAML SP or SAML IdP; crafted SAML requests crash the nsaaad daemon and repeated crashes can reboot the appliance, and CISA added it to KEV on 2026-10-04 for active targeted exploitation. No public weaponized PoC was identified - only defensive checker tooling - while Citrix ships Global Deny List signatures and a responder policy as interim mitigation.

Tia coverage

First reported2025-08-26

First exploit report2026-10-05

Exploit report → KEV1 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

citrix-netscaler-unpatched-rce-zero-days

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.