{"id":"citrix-netscaler-saml-dos-oct-2026","category":"patch","status":"closed","title":"Citrix NetScaler SAML crash flaw CVE-2026-88779 exploited in targeted attacks; fixes available","tldr":"Attackers are using CVE-2026-88779 to disrupt Citrix NetScaler ADC and Gateway appliances configured for SAML single sign-on. Fixes cover all affected supported branches. Ask your IT provider to check and update, even after earlier NetScaler patches.","summary":"Citrix disclosed CVE-2026-88779 on 3 October 2026, Pacific time, and released fixes for all affected supported NetScaler branches. The memory overflow affects customer-managed NetScaler ADC and Gateway appliances configured as a SAML service provider or identity provider for single sign-on. Attackers can interrupt service, and Citrix says repeated attacks could keep it unavailable. Citrix confirmed targeted exploitation, and CISA added the flaw to its exploited-vulnerability catalogue on 4 October. Secure Private Access Hybrid deployments using affected NetScaler instances also need updates. Citrix manages updates for its own cloud services. Earlier NetScaler security patches may not cover this flaw. Citrix also offers Global Deny List signatures for eligible deployments to reduce exposure while an upgrade is arranged; these do not replace the software fix. As at 3 November, the reviewed sources give no victim count or confirmation that attacks have stopped.","action":"Ask your workplace or family office IT provider to check any NetScaler appliances against the fixed versions below and install the appropriate update promptly. They should check again even if they recently applied other NetScaler security patches; ordinary Citrix app users cannot fix the appliance themselves.","product":"Citrix NetScaler ADC and NetScaler Gateway","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-88779"],"tags":["citrix","netscaler","gateway","saml","denial-of-service","exploited"],"affected":["Customer-managed NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.41, configured as a SAML SP or SAML IdP","Customer-managed NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.28, configured as a SAML SP or SAML IdP","NetScaler ADC 14.1-FIPS before 14.1-73.41 FIPS, configured as a SAML SP or SAML IdP","NetScaler ADC 13.1-FIPS and 13.1-NDcPP before 13.1-37.282, configured as a SAML SP or SAML IdP","Secure Private Access Hybrid deployments using affected NetScaler instances"],"fixed":["NetScaler ADC and NetScaler Gateway 14.1-73.41 and later releases","NetScaler ADC and NetScaler Gateway 13.1-64.28 and later releases of 13.1","NetScaler ADC 14.1-FIPS 14.1-73.41 FIPS and later releases of 14.1-FIPS","NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.282 and later releases of those branches"],"matches":[],"sources":[{"kind":"advisory","title":"Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88779","url":"https://support.citrix.com/external/article/CTX697174","by":"Citrix","date":"2026-10-03"},{"kind":"post","title":"Understanding and Addressing CVE-2026-88779 in Citrix NetScaler ADC and Citrix NetScaler Gateway","url":"https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/","by":"Citrix","date":"2026-10-04"},{"kind":"advisory","title":"Citrix security advisory (AV26-996)","url":"https://www.cyber.gc.ca/en/alerts-advisories/citrix-security-advisory-av26-996","by":"Canadian Centre for Cyber Security","date":"2026-10-05"},{"kind":"advisory","title":"Active Exploitation of Citrix NetScaler ADC and NetScaler Gateway Vulnerability (CVE-2026-88779)","url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4862","by":"NHS England","date":"2026-10-05"}],"started":"2026-10-03","closed":"2026-10-05","created":"2026-11-03T22:08:58.339Z","updated":"2026-11-03T22:08:58.339Z","cve_notes":[{"cve":"CVE-2026-88779","name":"Memory overflow in NetScaler SAML authentication","what":"A memory overflow in NetScaler ADC and Gateway configured as a SAML service provider or identity provider lets a remote attacker without signing in disrupt service.","severity":"high","cvss":8.7}],"timeline":[{"at":"2026-10-05","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"NHS England warned that continued exploitation was highly likely and urged affected organisations to apply Citrix's updates promptly.","url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4862","by":"NHS England","patch":null},{"at":"2026-10-04","added":"2026-11-03T22:00:26.134Z","kind":"cisa-added","text":"CISA added CVE-2026-88779 to its Known Exploited Vulnerabilities catalogue, according to the Canadian Centre for Cyber Security's subsequent advisory.","url":"https://www.cyber.gc.ca/en/alerts-advisories/citrix-security-advisory-av26-996","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-10-04","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"Citrix's accompanying blog reported targeted attacks against unmitigated deployments. Repeated attacks could keep services unavailable; customers who installed the preceding NetScaler security updates may need to upgrade again.","url":"https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/","by":"Citrix","patch":null},{"at":"2026-10-03","added":"2026-11-03T22:00:26.134Z","kind":"disclosed","text":"Citrix published its advisory for CVE-2026-88779, with fixes for all affected supported branches. Its changelog dates publication to 3 October, Pacific time.","url":"https://support.citrix.com/external/article/CTX697174","by":"Citrix","patch":"patched"}],"url":"https://hard.fyi/live/citrix-netscaler-saml-dos-oct-2026/","json":"https://hard.fyi/api/live?id=citrix-netscaler-saml-dos-oct-2026"}