Citrix NetScaler SAML crash flaw CVE-2026-88779 exploited in targeted attacks; fixes available
Attackers are using CVE-2026-88779 to disrupt Citrix NetScaler ADC and Gateway appliances configured for SAML single sign-on. Fixes cover all affected supported branches. Ask your IT provider to check and update, even after earlier NetScaler patches.
Ask your workplace or family office IT provider to check any NetScaler appliances against the fixed versions below and install the appropriate update promptly. They should check again even if they recently applied other NetScaler security patches; ordinary Citrix app users cannot fix the appliance themselves.
What’s happening
Citrix disclosed CVE-2026-88779 on 3 October 2026, Pacific time, and released fixes for all affected supported NetScaler branches. The memory overflow affects customer-managed NetScaler ADC and Gateway appliances configured as a SAML service provider or identity provider for single sign-on. Attackers can interrupt service, and Citrix says repeated attacks could keep it unavailable. Citrix confirmed targeted exploitation, and CISA added the flaw to its exploited-vulnerability catalogue on 4 October. Secure Private Access Hybrid deployments using affected NetScaler instances also need updates. Citrix manages updates for its own cloud services. Earlier NetScaler security patches may not cover this flaw. Citrix also offers Global Deny List signatures for eligible deployments to reduce exposure while an upgrade is arranged; these do not replace the software fix. As at 3 November, the reviewed sources give no victim count or confirmation that attacks have stopped.
- What
- Flaw
- Affects
- Citrix NetScaler ADC and NetScaler Gateway
- Affected
- Customer-managed NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.41, configured as a SAML SP or SAML IdP
Customer-managed NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.28, configured as a SAML SP or SAML IdP
NetScaler ADC 14.1-FIPS before 14.1-73.41 FIPS, configured as a SAML SP or SAML IdP
NetScaler ADC 13.1-FIPS and 13.1-NDcPP before 13.1-37.282, configured as a SAML SP or SAML IdP
Secure Private Access Hybrid deployments using affected NetScaler instances - Fixed in
- NetScaler ADC and NetScaler Gateway 14.1-73.41 and later releases
NetScaler ADC and NetScaler Gateway 13.1-64.28 and later releases of 13.1
NetScaler ADC 14.1-FIPS 14.1-73.41 FIPS and later releases of 14.1-FIPS
NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.282 and later releases of those branches - Since
- 3 Oct 2026
- Closed
- 5 Oct 2026
Timeline
- Update
NHS England warned that continued exploitation was highly likely and urged affected organisations to apply Citrix's updates promptly.
- CISA added
CISA added CVE-2026-88779 to its Known Exploited Vulnerabilities catalogue, according to the Canadian Centre for Cyber Security's subsequent advisory.
- Update
Citrix's accompanying blog reported targeted attacks against unmitigated deployments. Repeated attacks could keep services unavailable; customers who installed the preceding NetScaler security updates may need to upgrade again.
- Made publicFixed
Citrix published its advisory for CVE-2026-88779, with fixes for all affected supported branches. Its changelog dates publication to 3 October, Pacific time.
Sources
- Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88779Citrix · 3 Oct 2026
- Understanding and Addressing CVE-2026-88779 in Citrix NetScaler ADC and Citrix NetScaler GatewayCitrix · 4 Oct 2026
- Citrix security advisory (AV26-996)Canadian Centre for Cyber Security · 5 Oct 2026
- Active Exploitation of Citrix NetScaler ADC and NetScaler Gateway Vulnerability (CVE-2026-88779)NHS England · 5 Oct 2026