Active Exploitation of Citrix NetScaler SAML Memory Overflow Vulnerability (CVE-2026-88779)
October 16th, 2026
High
Our Cyber Threat Intelligence Unit is tracking active exploitation of CVE-2026-88779, a memory overflow vulnerability (CVSS 8.7, High) in the SAML authentication service of customer-managed Citrix NetScaler ADC and Gateway appliances. An unauthenticated attacker can crash the service with crafted requests and, if triggered repeatedly, keep it unavailable, risking organization-wide VPN and SSO outages. Citrix observed targeted attacks on unmitigated deployments, and the vulnerability has been reported as a zero-day exploited before patches were available. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on October 4, 2026, and notes that attackers may use it to force a reboot and accelerate conditions that allow execution of code previously injected through CVE-2026-88771. Earlier NetScaler updates (CTX697096, September 27, 2026) do not address it, so SAML-configured appliances on those builds remain affected.
Technical Details
CVE ID: CVE-2026-88779
Severity: High | CVSS v4.0: 8.7 (assigned by the NetScaler CNA)
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Threat Type: Memory overflow leading to denial of service (CWE-119)
Preconditions: NetScaler configured as a SAML SP (add authentication samlAction) or SAML IdP (add authentication samlIdPProfile), used with Gateway or AAA functionality
Affected Versions:
NetScaler ADC and Gateway 14.1 before 14.1-73.41
NetScaler ADC and Gateway 13.1 before 13.1-64.28
NetScaler ADC 14.1-FIPS before 14.1-73.41 FIPS
NetScaler ADC 13.1-FIPS and 13.1-NDcPP before 13.1-37.282
Fixed Versions: 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS and 13.1-37.282 or later. CTX697096 builds (from 14.1-73.37 and 13.1-64.23) must be upgraded again if SAML is configured.
Affected Products: Customer-managed NetScaler ADC and Gateway. Secure Private Access Hybrid deployments using NetScaler instances are also affected. Citrix upgrades its managed cloud services.
Exploitation Status: Citrix observed targeted attacks on unmitigated deployments; reported as a zero-day; CISA KEV October 4, 2026; ransomware use unknown.
Attack Chain:
Exposure: SAML authentication in conjunction with a Gateway or AAA virtual server.
Exploitation: An unauthenticated attacker sends crafted SAML authentication requests over the network (low complexity, no privileges, no user interaction). Orca reports the overflow occurs in the nsaaad SAML authentication handler.
Disruption: The SAML service crashes and, per Citrix, may remain unavailable if triggered repeatedly. Administrators reported nsaaad crashes ending in appliance reboots once the Pitboss process reached its restart limit (BleepingComputer).
Chaining (CISA): In unpatched deployments, a forced reboot may accelerate conditions that allow execution of code previously injected through CVE-2026-88771.
Reported injected commands (unconfirmed): BleepingComputer relayed an administrator’s report from 14.1-73.37 appliances of crafted SAML authentication fields containing shell commands that download a payload from 213.209.159[.]55, save it as /v and execute it, immediately before three nsaaad crash sequences. The administrator noted the logs showed attempted exploitation and correlated crashes but did not confirm successful execution. Researcher Kevin Beaumont separately reported a patched honeypot running a downloaded binary, and watchTowr Labs reproduced the vulnerability. Citrix has not confirmed code execution through CVE-2026-88779.
Impact
Denial of service: SAML authentication fails and appliances may reboot, disrupting VPN, SSO and remote access across an organization. Citrix's analysis indicates an availability impact and has not identified an impact on the integrity of customer data.
Chained compromise: On appliances already carrying code injected through CVE-2026-88771, forced reboots can turn an availability attack into a compromise.
Patch gap: Fixes released on September 27, 2026 (CTX697096) do not cover CVE-2026-88779, so appliances believed to be patched may remain exposed.
Detection Method
Review configuration for add authentication samlAction and add authentication samlIdPProfile to identify exposed appliances and their SAML role.
Check for compromise before patching using the indicators of compromise Citrix provides through NetScaler Console. A clean result does not rule out prior compromise.
Review /var/log/ns.log, /var/nslog/ and Syslog/NSLOG data, and forward logs to a SIEM, as local logs can rotate quickly and overwrite forensic artifacts.
Investigate repeated nsaaad crashes, Pitboss restarts and unexplained reboots, particularly after inbound SAML traffic. Treat these as high priority.
Inspect SAML authentication logs for usernames or other fields containing shell commands or download strings (curl, wget, fetch, file-write redirection). Search for an unexpected file named /v and review outbound connections to 213.209.159[.]55, particularly after a crash.
Where the Global Deny List is active, run show appfw signatures (Default Signatures version 24 or later) and stat denylist global AAA_REQUEST. A counter above 0 indicates the rules are working.
Monitor for SAML authentication errors, malformed requests and repeated failures from the same source. Review ns.conf, authentication policies, SAML configuration, administrator accounts and certificates for unexpected changes.
Indicators of Compromise
Indicator Type | Indicator | Description |
IP Address | 213.209.159[.]55 | Attacker IP observed in exploitation attempts (Orca); reported as the host serving the payload in injected commands (BleepingComputer) |
File Path | /v | File name reported as the save location for the downloaded payload (BleepingComputer); unconfirmed |
Recommendations
Upgrade SAML-configured appliances to 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS or 13.1-37.282 or later. Prioritize internet-facing SAML SP or IdP appliances.
Re-upgrade appliances on CTX697096 builds if they use SAML, verify exact build numbers, and upgrade NetScaler instances in Secure Private Access Hybrid deployments.
If an immediate upgrade is not possible, use Citrix's Global Deny List signatures as an interim mitigation. They require NetScaler Console with Virtual patching enabled and builds from 14.1-73.37 up to (not including) 14.1-73.41 or 13.1-64.23 up to (not including) 13.1-64.28. They do not replace upgrading.
Check for compromise and preserve forensic evidence before applying updates, as updates may reduce forensic visibility. Where operationally feasible, isolate appliances showing crashes, reboots or suspicious authentication entries.
If compromise is suspected or confirmed, restore a known good backup that pre-dates it, rotate all restored secrets (local account passwords, key-encryption keys, SSL certificates), and follow Citrix's "Steps to Take if NetScaler ADC is Suspected to be Compromised."
Block suspicious source IPs using the NetScaler blocklist and perimeter firewall rules, including 213.209.159[.]55.
Restrict administrative access to trusted management networks, enforce MFA for administrative accounts, and validate backup and recovery procedures for NetScaler configurations.
Conclusion
CVE-2026-88779 is an actively exploited vulnerability that can take down SAML authentication and, per CISA, can accelerate execution of code injected through CVE-2026-88771. Organizations should verify exact builds and SAML configuration, check for compromise and preserve evidence before patching, upgrade to 14.1-73.41, 13.1-64.28 or later, and investigate nsaaad crashes and suspicious authentication activity as potential compromise indicators.