Another week, another NetScaler zero-day being kicked to death in the wild. At this point Citrix bulletins arrive more reliably than my paycheck, and they come with better numbering.
If you run a NetScaler and you woke up today feeling relaxed, congratulations, you have not read your email. CISA dropped CVE-2026-88779 into the Known Exploited Vulnerabilities catalog on October 4, which is government-speak for “people are getting owned right now, please stop ignoring us.” This is on top of the ten-flaw pile Citrix disclosed on September 27 (CVE-2026-88771 through 88778, plus 107406). The gift that keeps on giving.
What happened
CVE-2026-88779 is a memory overflow bug in Citrix NetScaler ADC and NetScaler Gateway that lets an attacker knock the box over into a denial of service. Citrix carefully worded it as “we have observed targeted attacks on unmitigated NetScaler deployments which can lead to Denial of Service,” which is corporate for “yeah it is being exploited.” Hit it repeatedly and the service just stays down. It carries a CVSS 4.0 score of 8.7.
The catch, and there is always a catch: the box has to be configured as a SAML Service Provider or SAML Identity Provider, used alongside Gateway or AAA. If that is you, congrats, you are in scope. watchTowr and Bishop Fox get the credit for flagging it, and watchTowr says it reproduced the bug on a Saturday, because of course the internet breaks on weekends.
The nastier detail CISA added on October 9: on unpatched boxes, an attacker can use 88779 to force a reboot and accelerate conditions that let them run code previously injected through CVE-2026-88771. So the “just a DoS” framing undersells it when it is standing next to its RCE friends from the same bulletin.
Who is screwed
Anyone running NetScaler ADC or Gateway on these builds, with SAML in the mix:
- 14.1 before 14.1-73.41
- 13.1 before 13.1-64.28
- NetScaler ADC FIPS before 14.1-73.41 FIPS
- NetScaler ADC FIPS and NDcPP before 13.1-37.282
Secure Private Access hybrid deployments that lean on NetScaler instances are also affected. Citrix-managed cloud stuff gets patched by the vendor, so if you pay them to babysit it, this one is their problem. Everyone self-hosting, it is your weekend.
And here is the part that should make a CISO twitch: Citrix explicitly warned that no previously issued patch fixes this. If you patched the September batch and told the board you were done, you were not done. You were patched into a false sense of security, which is the most expensive kind.
Technical breakdown
The vuln lives in NetScaler’s SAML handling. SAML SP/IdP is the enterprise single-sign-on glue that lets your users log in once and get into everything, which is also why a bug here is juicy: the box sits at the front door, internet-facing, authenticating the world. A memory overflow in that path means a crafted request chews up or corrupts memory until the service falls over. Repeat it and it stays down. CWE-119, classic improper restriction of operations within the bounds of a memory buffer, which is a fancy way of saying “someone wrote past the end of the thing.”
No public proof-of-concept with full technical detail has dropped yet. watchTowr reproduced it but has not published the recipe, which is the responsible move and also the kind of thing that buys you about a week before someone else does.
There are no clean file-hash IOCs for 88779 itself because it is a crash bug, not a dropper. For the related 88771/88772 exploitation, Citrix published IOCs you can run from the NetScaler console, and CISA flagged those two as requiring forensic triage. Translation: if you were exposed, assume you need to look for a body, not just apply a patch.
What to do Monday morning
- Check if SAML is even configured. Look for a SAML authentication action or a SAML IdP profile entry. No SAML, no 88779 exposure, go have a coffee. But you still have the rest of the bulletin to deal with.
- Upgrade. To 14.1-73.41+, 13.1-64.28+, or the matching FIPS/NDcPP build. Older patches do not count. Stop asking.
- Use the Global Deny List. Citrix pushed signatures to block known malicious IPs while you plan the upgrade. It is a band-aid, not a fix, but band-aids beat bleeding.
- Do the forensic triage for 88771/88772. Run Citrix’s IOC checks from the console. If you find signs of compromise, follow Citrix article CTX694799 and assume injected code may already be resident. A patch does not evict a tenant.
- Stop putting management planes on the open internet. I will keep saying it until it stops being true, which is never.
Sources
- CISA KEV catalog entry CVE-2026-88779 (added 2026-10-04): known_exploited_vulnerabilities.json
- CISA Alert, Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler (updated 2026-10-09): cisa.gov
- Help Net Security, CISA flags new exploited NetScaler flaw (2026-10-05): helpnetsecurity.com
- Citrix Security Bulletin CTX697174: support.citrix.com
- watchTowr FAQ on CVE-2026-88779: watchtowr.com
- GovInfoSecurity coverage: govinfosecurity.com
