{"id":"CVE-2026-88779","kind":"vulnerability","aliases":["CVE-2026-88779"],"related":[],"title":"Vulnerability in NetScaler ADC and NetScaler Gateway","description":"Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Memory overflow (CWE-119) in NetScaler ADC/Gateway SAML handling, CVSS v4 8.7. Unauthenticated, remote. Citrix calls it DoS (repeated crashes of nsaaad, appliance reboots). Exploited as zero-day; admins and researchers (Kevin Beaumont) saw crafted SAML usernames dropping a payload from 213.209.159[.]55 on patched honeypots, so RCE is suspected but unconfirmed. Applies only when configured as SAML SP or IdP. Appliances already upgraded for CVE-2026-88771..88778 (e.g. 14.1-73.37) must be upgraded again.","severity":"high","cvss":8.7,"epss":null,"exploited":true,"exploited_at":"2026-10-04T00:00:00+00:00","products":[{"name":"Citrix NetScaler","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"NetScaler ADC and Gateway 14.1","fixed":["14.1-73.41"],"affected":"< 14.1-73.41","ecosystem":"vendor"},{"name":"NetScaler ADC and Gateway 13.1","fixed":["13.1-64.28"],"affected":"< 13.1-64.28","ecosystem":"vendor"},{"name":"NetScaler ADC 14.1-FIPS","fixed":["14.1-73.41 FIPS"],"affected":"< 14.1-73.41 FIPS","ecosystem":"vendor"},{"name":"NetScaler ADC 13.1-FIPS and 13.1-NDcPP","fixed":["13.1-37.282"],"affected":"< 13.1-37.282","ecosystem":"vendor"},{"name":"citrix netscaler application delivery controller","fixed":["13.1-37.282"],"affected":">= 13.1, < 13.1-37.282","ecosystem":"vendor"},{"name":"citrix netscaler application delivery controller","fixed":["13.1-64.28"],"affected":">= 13.1, < 13.1-64.28","ecosystem":"vendor"},{"name":"citrix netscaler application delivery controller","fixed":["14.1-73.41"],"affected":">= 14.1, < 14.1-73.41","ecosystem":"vendor"},{"name":"citrix netscaler application delivery controller","fixed":[],"affected":">= 14.1-66.68, <= 14.1-73.41","ecosystem":"vendor"},{"name":"citrix netscaler gateway","fixed":["13.1-64.28"],"affected":">= 13.1, < 13.1-64.28","ecosystem":"vendor"},{"name":"citrix netscaler gateway","fixed":["14.1-73.41"],"affected":">= 14.1, < 14.1-73.41","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["citrix","exploited","gateway","infrastructure","netscaler","saml","self-hosted"],"not_affected_if":["managed-hosting","no-saml-config"],"how_to_check":"Check the NetScaler config (ns.conf) for 'add authentication samlAction' (SAML SP) or 'add authentication samlIdPProfile' (SAML IdP). If either is present and the build is older than the fixed version, you are exposed. Look for repeated nsaaad crashes or Pitboss reboots, and SAML auth log entries with shell commands in the username.","fix":"Upgrade to NetScaler ADC/Gateway 14.1-73.41 or later, or 13.1-64.28 or later 13.1; ADC 14.1-FIPS 14.1-73.41 FIPS or later; ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.282 or later. Citrix also offers Global Deny Lists for known malicious IPs as an interim measure only. Secure Private Access Hybrid NetScaler instances need the same upgrade.","status":"open","published_at":"2026-10-04T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:50+00:00","triaged_at":"2026-10-23T19:50:04+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T19:50:04Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or patch per Citrix instructions; the sources do not name the fixed version. Discontinue use if no mitigation is available, per CISA guidance.","summary":"Citrix NetScaler ADC and NetScaler Gateway contain a memory buffer bounds bug that lets an attacker cause a denial of service. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["netscaler","citrix","self-hosted","gateway"],"confidence":0.6,"analyst_note":"Find the Citrix security bulletin for CVE-2026-88779 to get affected and fixed versions and exposure checks; sources here give none.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"severity_if_unknown":"high"},"cost_usd":0.000369,"input_tokens":2250,"output_tokens":288,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the Citrix security bulletin for CVE-2026-88779 to get affected and fixed versions and exposure checks; sources here give none.","search":"'-04':200C,226C,257C '-119':75B '-2026':9A,12A,139B '-73.37':144B '-88771':140B '-88779':10A,13A '13.1':25A,32A,35A '14.1':20A,28A,143B '213.209.159':114B '26':199C,225C,256C '55':115B '8.7':83B '88778':141B 'accord':189C 'action':185C 'adc':4A,17A,22A,27A,31A,150C,153C 'adc/gateway':78B 'adher':253C 'admin':101B 'allow':177C 'alreadi':135B 'and':18A,23A,34A 'appli':125B,186C 'applianc':94B,134B 'applic':223C 'application':39A,44A,49A,54A 'asset':247C 'base':204C 'beaumont':105B 'bod':198C,224C,255C 'bound':169C 'buffer':173C 'call':87B 'cisa':183C,196C,213C 'citrix':14A,37A,42A,47A,52A,57A,60A,63B,86B,148C,152C,155C,159C 'cloud':229C 'complianc':194C 'configur':128B 'contain':161C 'controller':41A,46A,51A,56A 'could':176C 'craft':107B 'crash':91B 'cve':8A,11A,138B 'cvss':81B 'cwe':74B 'day':100B 'delivery':40A,45A,50A,55A 'denial':180C 'discontinu':232C 'dos':89B 'drop':110B 'e.g':142B 'ensur':193C,252C 'evalu':245C 'exploit':64B,96B 'exposur':250C 'fips':29A,33A 'follow':222C 'forens':215C 'former':151C,158C 'gateway':7A,19A,24A,59A,62A,65B,157C,160C 'guidanc':211C,227C 'guidelin':259C 'handl':80B 'honeypot':118B 'host':71B 'idp':133B 'improp':163C 'infrastructur':66B 'instruct':192C 'internet':249C 'kevin':104B 'memori':72B,172C 'mitig':187C,238C 'must':145B 'ndcpp':36A 'netscal':3A,6A,67B,77B,149C,156C 'netscaler':15A,16A,21A,26A,30A,38A,43A,48A,53A,58A,61A 'note':210C,221C 'nsaaad':93B 'oper':166C 'overflow':73B 'patch':117B,258C 'payload':112B 'priorit':201C 'product':236C 'rce':120B 'reboot':95B 'remot':85B 'repeat':90B 'requir':184C,217C 'research':103B 'respons':243C 'restrict':164C 'risk':206C 'saml':68B,79B,108B,130B 'saw':106B 'secur':202C 'see':207C,218C 'self':70B 'self-host':69B 'servic':182C,230C 'sp':131B 'stakehold':241C 'suspect':122B 'triag':216C 'unauthent':84B 'unavail':240C 'unconfirm':124B 'updat':203C 'upgrad':136B,147B 'url':208C,219C 'use':233C 'usernam':109B 'v4':82B 'vendor':191C 'vulner':1A,174C 'within':167C 'zero':99B 'zero-day':98B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-04T00:00:00+00:00","kev":{"dateAdded":"2026-10-04","dueDate":"2026-10-07","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-88779","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-88779","severity":null,"published_at":"2026-10-04T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:50+00:00","fetched_at":"2026-10-25T12:39:21+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-88779:111","url":null,"severity":null,"published_at":"2026-10-23T21:36:03+00:00","modified_at":"2026-10-23T21:36:08+00:00","first_seen_at":"2026-10-23T21:36:03+00:00","fetched_at":"2026-10-23T21:36:08+00:00","note":"Read Citrix CTX697174 (primary), BleepingComputer, CISA alert. Exploited zero-day, KEV 2026-10-04; possible RCE reported by researchers but not confirmed by Citrix. No public PoC link found. No X/Bluesky search done."},{"source":"nvd","external_id":"CVE-2026-88779","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88779","severity":null,"published_at":"2026-10-04T04:16:43+00:00","modified_at":"2026-10-05T13:35:24+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":1124,"url":"https://support.citrix.com/external/article/CTX697174/citrix-netscaler-adc-and-citrix-netscale.html","title":"Citrix bulletin CTX697174 CVE-2026-88779","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1127,"url":"https://www.bleepingcomputer.com/news/security/citrix-patches-netscaler-saml-zero-day-exploited-in-attacks/","title":"BleepingComputer: Citrix patches NetScaler SAML zero-day","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null},{"id":8,"url":"https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway","title":"CISA alert: Citrix NetScaler zero-days","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}