SAML-Conditioned Memory Overflow for NetScaler — CVE-2026-88779 Don Enter KEV (Due October 7)
Citrix don show memory-buffer-bounds flaw for NetScaler ADC / Gateway (CVE-2026-88779, CVSS v4.0 8.7, CWE-119). Citrix say dem observe targeted attacks on deployments wey never get mitigation, and the attacks fit lead to denial of service. CISA KEV listing show say the vulnerability don dey exploited, and the short description say the flaw fit allow denial of service. No one among the two sources confirm say affected deployments don actually go down. CISA add am on October 4, federal due date na October 7. Together with CVE-2026-88771 and CVE-2026-88772 (both added September 27), na the third NetScaler KEV entry wey dem add within two weeks, no be the product third KEV for all time (earlier entries include CVE-2023-4966). Global Deny List signatures (v24 or later) na the interim mitigation, and the fix dey for 14.1-73.41 / 13.1-64.28 or later.
Dis article na machine translation.
On October 3 (Pacific Daylight Time), Citrix don publish CVE-2026-88779 for NetScaler ADC (wey before na Citrix ADC) and NetScaler Gateway (wey before na Citrix Gateway) for security bulletin CTX697174 and community explainer. Dem classify am as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) with CVSS v4.0 base score of 8.7 (CNA: NetScaler). The problem dey affect customer-managed NetScaler deployments wey dey use SAML authentication together with Gateway or AAA functionality. Affected versions na ADC and Gateway 14.1 before 14.1-73.41 and 13.1 before 13.1-64.28, ADC FIPS before 14.1-73.41 FIPS, and ADC FIPS and NDcPP before 13.1-37.282 (Citrix CTX697174; NVD don publish October 4, 2026). Citrix say dem observe targeted attacks on deployments wey never get mitigation, and the attacks fit lead to denial of service. CISA KEV short description say the flaw fit allow denial of service, and the listing show say the vulnerability don dey exploited. No one among the two sources confirm say affected deployments don actually go down. Citrix analysis no identify any impact on the integrity of customer data.
CISA don add the vulnerability for its KEV catalog on October 4, and dem give federal civilian agencies until October 7 to respond (BOD 26-04, three days from listing). The KEV notes say you must apply vendor-directed mitigations wey dey follow BOD 26-04 and CISA's Forensics Triage Requirements; forensic triage don flag Yes and known ransomware campaign use na Unknown (CISA KEV catalog 2026.10.04, 1,734 entries total). Citrix don propose configuration self-check for the preconditions: if your deployment be configured as SAML SP (add authentication samlAction) or as SAML IdP (add authentication samlIdPProfile), then e meet the conditions. Citrix-shipped Global Deny List signatures (v24 or later) dey available for 14.1-73.37 or later up to before 14.1-73.41, and for 13.1-64.23 or later up to before 13.1-64.28, with NetScaler Console virtual patching enabled and Encrypted Version visible for show appfw signatures.
Analysis (wey we keep separate from reporting): the two KEV entries wey dem add on September 27 no depend on SAML. CTX697096 say CVE-2026-88771 (improper input validation wey fit let unauthenticated attacker run arbitrary commands) affect all NetScaler ADC and NetScaler Gateway deployments, including default configuration, and no extra feature dey required. CTX697096 say CVE-2026-88772 (memory overflow wey fit lead to remote code execution or denial of service) need DTLS, and DTLS dey on by default for VPN vServer. Together with CVE-2026-88779 wey dem add on October 4, na three NetScaler KEV entries wey dem add within two weeks. The catalog don already get earlier NetScaler entries, including CVE-2023-4966 (added October 18, 2023), so this one no be the product third KEV for all time. Citrix no say whether these three get the same root cause. Citrix-managed cloud services dey outside the bulletin for customer-managed deployments.
Implications for defenders: (1) if your environment get SAML SP or IdP configuration, verify the deployed version against CTX697174 immediately and upgrade 14.1 to 14.1-73.41 or later, 13.1 to 13.1-64.28 or later, and FIPS / NDcPP to 14.1-73.41 FIPS / 13.1-37.282 or later; environments wey don already upgrade for CTX697096 (the CVE-2026-88771 through CVE-2026-88778 bulletin) still need another upgrade if dem meet the preconditions. (2) As interim mitigation until the upgrade, apply the Global Deny List signatures (v24 or later) and check the counters with stat denylist global AAA_REQUEST. Citrix verification procedure say a value wey big pass zero mean say the rules dey work. (3) The KEV notes set forensicTriage to Yes and dem require forensic triage under BOD 26-04. For this vulnerability, CTX697174 precondition na SAML SP (add authentication samlAction) or SAML IdP (add authentication samlIdPProfile). CVE-2026-88771 and CVE-2026-88772 get different preconditions for CTX697096.