SAML-Conditioned Memory Overflow in NetScaler — CVE-2026-88779 Added to KEV (Due October 7)
Citrix disclosed a memory-buffer-bounds flaw in NetScaler ADC / Gateway (CVE-2026-88779, CVSS v4.0 8.7, CWE-119). Citrix says it observed targeted attacks on unmitigated deployments that can lead to denial of service. CISA's KEV listing establishes exploitation of the vulnerability, and its short description says the flaw could allow a denial of service. Neither source confirms that affected deployments were taken down. CISA added it on October 4 with a federal due date of October 7. Together with CVE-2026-88771 and CVE-2026-88772 (both added September 27), it is the third NetScaler KEV entry added within two weeks, not the product's third KEV overall (earlier entries include CVE-2023-4966). Global Deny List signatures (v24 or later) are the interim mitigation, and the fix ships in 14.1-73.41 / 13.1-64.28 or later.
De artikeltekst is niet beschikbaar in deze taal; de Engelse versie wordt getoond.
On October 3 (Pacific Daylight Time), Citrix published CVE-2026-88779 for NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) in security bulletin CTX697174 and a community explainer. It is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) with a CVSS v4.0 base score of 8.7 (CNA: NetScaler). The issue affects customer-managed NetScaler deployments that use SAML authentication together with Gateway or AAA functionality. Affected versions are ADC and Gateway 14.1 before 14.1-73.41 and 13.1 before 13.1-64.28, ADC FIPS before 14.1-73.41 FIPS, and ADC FIPS and NDcPP before 13.1-37.282 (Citrix CTX697174; NVD published October 4, 2026). Citrix says it has observed targeted attacks against unmitigated deployments that can lead to denial of service. CISA's KEV short description says the flaw could allow a denial of service, and the listing establishes exploitation of the vulnerability. Neither source confirms that affected deployments were successfully taken down. Citrix's analysis has not identified an impact on the integrity of customer data.
CISA added the vulnerability to its KEV catalog on October 4, giving federal civilian agencies until October 7 to respond (BOD 26-04, three days from listing). The KEV notes require applying vendor-directed mitigations in line with BOD 26-04 and CISA's Forensics Triage Requirements; forensic triage is flagged Yes and known ransomware campaign use is Unknown (CISA KEV catalog 2026.10.04, 1,734 entries total). Citrix proposes a configuration self-check for the preconditions: a deployment meets them if it is configured as a SAML SP (add authentication samlAction) or as a SAML IdP (add authentication samlIdPProfile). Citrix-shipped Global Deny List signatures (v24 or later) are available on 14.1-73.37 or later up to before 14.1-73.41, and on 13.1-64.23 or later up to before 13.1-64.28, with NetScaler Console virtual patching enabled and an Encrypted Version visible in show appfw signatures.
Analysis (kept separate from reporting): the two KEV entries added on September 27 are not SAML-conditioned. CTX697096 says CVE-2026-88771 (improper input validation that could let an unauthenticated attacker execute arbitrary commands) affects all NetScaler ADC and NetScaler Gateway deployments, including the default configuration, with no additional feature required. CTX697096 says CVE-2026-88772 (a memory overflow that can lead to remote code execution or denial of service) requires DTLS, which is enabled by default on a VPN vServer. Together with CVE-2026-88779, added on October 4, that is three NetScaler KEV entries added within two weeks. The catalog already contains earlier NetScaler entries, including CVE-2023-4966 (added October 18, 2023), so this is not the product's third KEV overall. Citrix does not say whether these three share a root cause. Citrix-managed cloud services are outside the customer-managed bulletin.
Implications for defenders: (1) if your environment has SAML SP or IdP configuration, verify the deployed version against CTX697174 immediately and upgrade 14.1 to 14.1-73.41 or later, 13.1 to 13.1-64.28 or later, and FIPS / NDcPP to 14.1-73.41 FIPS / 13.1-37.282 or later; environments that already upgraded for CTX697096 (the CVE-2026-88771 through CVE-2026-88778 bulletin) still need another upgrade if they meet the preconditions. (2) As an interim mitigation until the upgrade, apply the Global Deny List signatures (v24 or later) and check the counters with stat denylist global AAA_REQUEST. Citrix's verification procedure says a value greater than zero indicates that the rules are working. (3) The KEV notes set forensicTriage to Yes and require forensic triage under BOD 26-04. For this vulnerability, CTX697174's precondition is a SAML SP (add authentication samlAction) or a SAML IdP (add authentication samlIdPProfile). CVE-2026-88771 and CVE-2026-88772 have different preconditions in CTX697096.