Live › vulnerability › CVE-2026-88779
Go to dashboardMemory overflow (CWE-119) in NetScaler ADC/Gateway SAML handling, CVSS v4 8.7. Unauthenticated, remote. Citrix calls it DoS (repeated crashes of nsaaad, appliance reboots). Exploited as zero-day; admins and researchers (Kevin Beaumont) saw crafted SAML usernames dropping a payload from 213.209.159[.]55 on patched honeypots, so RCE is suspected but unconfirmed. Applies only when configured as SAML SP or IdP. Appliances already upgraded for CVE-2026-88771..88778 (e.g. 14.1-73.37) must be upgraded again.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Citrix NetScaler | vendor | – | – |
| NetScaler ADC and Gateway 14.1 | vendor | < 14.1-73.41 | 14.1-73.41 |
| NetScaler ADC and Gateway 13.1 | vendor | < 13.1-64.28 | 13.1-64.28 |
| NetScaler ADC 14.1-FIPS | vendor | < 14.1-73.41 FIPS | 14.1-73.41 FIPS |
| NetScaler ADC 13.1-FIPS and 13.1-NDcPP | vendor | < 13.1-37.282 | 13.1-37.282 |
| citrix netscaler application delivery controller | vendor | >= 13.1, < 13.1-37.282 | 13.1-37.282 |
| citrix netscaler application delivery controller | vendor | >= 13.1, < 13.1-64.28 | 13.1-64.28 |
| citrix netscaler application delivery controller | vendor | >= 14.1, < 14.1-73.41 | 14.1-73.41 |
| citrix netscaler application delivery controller | vendor | >= 14.1-66.68, <= 14.1-73.41 | – |
| citrix netscaler gateway | vendor | >= 13.1, < 13.1-64.28 | 13.1-64.28 |
| citrix netscaler gateway | vendor | >= 14.1, < 14.1-73.41 | 14.1-73.41 |
add authentication samlAction (SAML SP) or add authentication samlIdPProfile (SAML IdP)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Posts are quoted with a link to the original. They are data to us, never instructions.
Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
This page as .md · .json · in your agent: get_signal("CVE-2026-88779")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.