Citrix Releases Emergency Fixes for Actively Exploited NetScaler SAML Zero-Day
Citrix has issued urgent security updates for a newly discovered zero-day vulnerability in its NetScaler ADC and NetScaler Gateway appliances, tracked as CVE-2026-88779. The flaw, disclosed on October 4, 2026, affects systems using SAML authentication with Gateway or AAA functionality and has already been observed in targeted attacks causing denial-of-service conditions. Citrix confirmed the vulnerability carries a CVSS score of 8.7 and emphasized that while service availability is impacted, there is no evidence of customer data integrity being compromised.
The patches were released early Sunday morning and include NetScaler ADC and NetScaler Gateway versions 14.1-73.41 and 13.1-64.28. For FIPS-compliant deployments, Citrix advises upgrading to 14.1-73.41 FIPS, while NetScaler ADC FIPS and NDcPP customers on the 13.1 branch should install version 13.1-37.282. In addition to the software updates, Citrix is providing Global Deny Lists to block traffic from known malicious IP addresses, though it stresses that applying the security patches remains the primary mitigation.
How to Determine If Your NetScaler Appliance Is Vulnerable
Organizations can check whether their devices are at risk by verifying if SAML authentication is configured. Specifically, vulnerability exists if the appliance is set up as a SAML Service Provider (SP) with an authentication samlAction command or as a SAML Identity Provider (IdP) with an authentication samlIdPProfile setting. Citrix urges administrators to review these configurations immediately, especially if they recently upgraded systems to address prior vulnerabilities.
"If you upgraded your NetScaler deployment with one of the updated software releases identified in the security bulletin for CVE 2026-88771 through CVE 2026-88778, and if you have determined that your NetScaler deployment meets the preconditions describe above, please upgrade your deployment again,"
— Citrix Security Advisory
Investigations Suggest Potential for Remote Code Execution Beyond DoS
Although Citrix initially characterized CVE-2026-88779 as a denial-of-service issue, multiple administrators and researchers have reported indicators suggesting the flaw could be leveraged for remote code execution. Early signs emerged when administrators observed recently patched NetScaler 14.1-73.37 appliances undergoing repeated, unexplained reboots. One Reddit user described seeing authentication usernames containing shell commands that attempted to download a payload from IP address 213.209.159[.]55, save it as /v, and execute it. These requests appeared immediately before confirmed crashes of the nsaaad process.
The administrator noted that while the logs showed correlated crash sequences and exploitation attempts, they did not confirm successful payload execution. Similar patterns were reported by other administrators, including on systems rebuilt from clean images and those already upgraded to 14.1-73.37. The recurring crashes often involved the Pitboss process hitting its restart limit, triggering a full appliance reboot.
Security Researchers and Honeypot Observations Support Code Execution Theory
Cybersecurity expert Kevin Beaumont reported that his patched NetScaler 13.1 and 14.1 honeypots were crashing after receiving malicious requests from multiple IP addresses. In one case, a honeypot was observed running a downloaded malware binary despite being fully patched, leading Beaumont to conclude a new vulnerability was being actively exploited. He compared the situation to CVE-2025-6543, which was initially thought to be denial-of-service only before later revealed to enable remote code execution.
WatchTowr Labs also confirmed it successfully reproduced the vulnerability in its lab environment after analyzing honeypot traffic, though the company has not yet released technical details about the exploit mechanism. Their findings align with administrator reports of crafted SAML requests triggering instability in NetScaler processes.
CISA Adds CVE-2026-88779 to Known Exploited Vulnerabilities Catalog
On Sunday, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-88779 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. As a result, Federal Civilian Executive Branch (FCEB) agencies are required to apply mitigations by October 7, 2026. CISA’s inclusion underscores the severity of the threat and the urgency for organizations to prioritize patching.
Citrix maintains that the safest course of action is to install the latest security updates immediately, regardless of recent patching efforts for prior flaws such as CVE-2026-88771 through CVE-2026-88778. Administrators are advised to verify SAML configuration, apply the appropriate firmware version, and monitor for signs of abnormal process crashes or unexpected reboots as potential indicators of ongoing exploitation attempts.
Source: BleepingComputer