NetScaler SAML zero-day CVE-2026-88779: check Gateway and AAA SAML configurations and upgrade to 14.1-73.41 or 13.1-64.28

NetScaler SAML zero-day CVE-2026-88779: check Gateway and AAA SAML configurations and upgrade to 14.1-73.41 or 13.1-64.28

4 October 2026: A week after the CTX697096 flaws, NetScaler administrators face another weekend emergency. Citrix's NetScaler threat-intelligence team published guidance on 3 October 2026 about a newly observed issue in customer-managed NetScaler deployments that use SAML authentication with Gateway or AAA. A security bulletin followed early on 4 October, assigning CVE-2026-88779, according to heise online, which reports that an exploit was already circulating and that patched builds were released over the weekend.

What is affected

Citrix says the issue depends on configuration. A NetScaler is affected when it acts as a Gateway or AAA virtual server and its configuration contains at least one of these commands:

• add authentication samlAction
• add authentication samlIdPProfile

In other words, appliances set up as a SAML service provider or SAML identity provider. Citrix states that the issue is independent of the vulnerabilities in bulletin CTX697096 (CVE-2026-88771 and CVE-2026-88772), which we covered last week. A security researcher quoted by heise suggests it may be a way around that earlier fix; Citrix has not said so.

The NVD record, published on 4 October, rates CVE-2026-88779 8.7 on CVSS 4 and scores its impact on availability only, and CISA lists it as a memory-buffer flaw. heise wrote that it could also allow code to be run, which neither record supports. heise reports that it can be triggered by sending large numbers of SAML requests. Administrators on Citrix's forums and elsewhere have reported appliances rebooting under scans.

Fixed builds

The NVD record lists the fixed builds:

• NetScaler ADC and Gateway 14.1-73.41 and later
• 13.1-64.28 and later
• 14.1-73.41 FIPS and later
• 13.1-37.282 and later of 13.1-FIPS and 13.1-NDcPP

What to do

1. Search every NetScaler configuration for the two SAML commands above. If neither is present, Citrix's guidance indicates the appliance is not exposed to this issue, though last week's patches still apply.
2. If either is present, upgrade to a fixed build now. Confirm the exact builds against Citrix's own bulletin before you schedule the change.
3. If appliances are crashing or rebooting, contact Citrix support, as Citrix advises, and preserve logs before rebooting.
4. Treat any appliance that was exposed and unpatched as possibly compromised: review sessions, new admin accounts and outbound connections.
5. Subscribe to Citrix security bulletin alerts, since guidance on this issue is still being updated.

Correction, 29 October 2026: an earlier version of this item repeated heise's description of the flaw as able to run code. The NVD record and CISA's catalogue describe a memory-buffer flaw with availability impact only, and the item now says so.

Why it matters for buyers

NetScaler sits at the edge of many corporate networks and carries single sign-on for remote staff. Two serious flaws in two weeks, each exploited before most customers could patch, is a reason to review how quickly your team can patch edge appliances over a weekend, and whether a managed or cloud-delivered alternative would shift that burden.

Related on TrustList:

• Citrix fixes CVSS 9.5 NetScaler SAML flaw; no attacks seen so far
• Siemens fixes a SAML replay flaw in the Mendix single sign-on module
• Grafana fixes SSO secret exposure and Azure token leak flaws

Sources

• Citrix Community (NetScaler Cyber Threat Intelligence): Security Update: Guidance for NetScaler SAML Authentication Deployments - 3 October 2026
• heise online: Netscaler-Admins aufgepasst: Zero-Day verursacht Crashes und Codeausführung - 4 October 2026
• CISA Known Exploited Vulnerabilities catalogue: CVE-2026-88779, Citrix NetScaler (added 4 October 2026) - 4 October 2026
• NVD: CVE-2026-88779 - 4 October 2026