Citrix has warned of targeted attacks against its NetScaler ADC and NetScaler Gateway products through a high-severity vulnerability, CVE-2026-88779, which the US Cybersecurity and Infrastructure Security Agency (CISA) added to its Known Exploited Vulnerabilities (KEV) catalog on 4 October 2026. Federal civilian agencies were ordered to patch or mitigate by 7 October.

What the flaw does

CVE-2026-88779 is a memory overflow vulnerability, carrying a CVSS score of 8.7, in NetScaler ADC and Gateway appliances configured as a SAML service provider or identity provider with Gateway or AAA functionality. Specially crafted SAML authentication traffic can trigger a memory overflow in the packet processing engine, causing the affected virtual server to crash and disrupting user sessions. If attackers repeatedly exploit the condition, the service may remain unavailable, causing prolonged outages for VPN, single sign-on or application delivery services fronted by NetScaler. Citrix says it has observed targeted attacks against unmitigated deployments, but that the integrity of customer data has not been impacted.

Who is affected and what to do

Affected versions are NetScaler ADC and Gateway 14.1 before 14.1-73.41 and 13.1 before 13.1-64.28, including corresponding FIPS and NDcPP builds, with Secure Private Access Hybrid deployments that use NetScaler instances also affected. Administrators can check whether the precondition applies by looking for add authentication samlAction (SAML service provider) or add authentication samlIdPProfile (SAML identity provider) in their configuration. Citrix urges affected customers to install the updated versions as soon as possible, and has released signatures that can be deployed through the NetScaler Global Deny List feature to reduce exposure while upgrades are planned. Citrix-managed cloud services and Citrix-managed Adaptive Authentication are not affected, as Cloud Software Group upgrades those platforms itself.

Sources: Infosecurity Magazine, Sophos, Security Affairs