---
id: "CVE-2026-88779"
kind: "vulnerability"
aliases: ["CVE-2026-88779"]
title: "Vulnerability in NetScaler ADC and NetScaler Gateway"
severity: "high"
cvss: 8.7
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Citrix NetScaler", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "NetScaler ADC and Gateway 14.1", "fixed": ["14.1-73.41"], "affected": "< 14.1-73.41", "ecosystem": "vendor"}, {"name": "NetScaler ADC and Gateway 13.1", "fixed": ["13.1-64.28"], "affected": "< 13.1-64.28", "ecosystem": "vendor"}, {"name": "NetScaler ADC 14.1-FIPS", "fixed": ["14.1-73.41 FIPS"], "affected": "< 14.1-73.41 FIPS", "ecosystem": "vendor"}, {"name": "NetScaler ADC 13.1-FIPS and 13.1-NDcPP", "fixed": ["13.1-37.282"], "affected": "< 13.1-37.282", "ecosystem": "vendor"}, {"name": "citrix netscaler application delivery controller", "fixed": ["13.1-37.282"], "affected": ">= 13.1, < 13.1-37.282", "ecosystem": "vendor"}, {"name": "citrix netscaler application delivery controller", "fixed": ["13.1-64.28"], "affected": ">= 13.1, < 13.1-64.28", "ecosystem": "vendor"}, {"name": "citrix netscaler application delivery controller", "fixed": ["14.1-73.41"], "affected": ">= 14.1, < 14.1-73.41", "ecosystem": "vendor"}, {"name": "citrix netscaler application delivery controller", "fixed": [], "affected": ">= 14.1-66.68, <= 14.1-73.41", "ecosystem": "vendor"}, {"name": "citrix netscaler gateway", "fixed": ["13.1-64.28"], "affected": ">= 13.1, < 13.1-64.28", "ecosystem": "vendor"}, {"name": "citrix netscaler gateway", "fixed": ["14.1-73.41"], "affected": ">= 14.1, < 14.1-73.41", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["citrix", "exploited", "gateway", "infrastructure", "netscaler", "saml", "self-hosted"]
not_affected_if: ["managed-hosting", "no-saml-config"]
published_at: "2026-10-04T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:50+00:00"
updated_at: "2026-10-23T23:44:52+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-88779", "first_seen_at": "2026-10-23T19:11:50+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:36:03+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88779", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# Vulnerability in NetScaler ADC and NetScaler Gateway

Memory overflow (CWE-119) in NetScaler ADC/Gateway SAML handling, CVSS v4 8.7. Unauthenticated, remote. Citrix calls it DoS (repeated crashes of nsaaad, appliance reboots). Exploited as zero-day; admins and researchers (Kevin Beaumont) saw crafted SAML usernames dropping a payload from 213.209.159[.]55 on patched honeypots, so RCE is suspected but unconfirmed. Applies only when configured as SAML SP or IdP. Appliances already upgraded for CVE-2026-88771..88778 (e.g. 14.1-73.37) must be upgraded again.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Citrix NetScaler affected ? fixed ?
- vendor:NetScaler ADC and Gateway 14.1 affected < 14.1-73.41 fixed 14.1-73.41
- vendor:NetScaler ADC and Gateway 13.1 affected < 13.1-64.28 fixed 13.1-64.28
- vendor:NetScaler ADC 14.1-FIPS affected < 14.1-73.41 FIPS fixed 14.1-73.41 FIPS
- vendor:NetScaler ADC 13.1-FIPS and 13.1-NDcPP affected < 13.1-37.282 fixed 13.1-37.282
- vendor:citrix netscaler application delivery controller affected >= 13.1, < 13.1-37.282 fixed 13.1-37.282
- vendor:citrix netscaler application delivery controller affected >= 13.1, < 13.1-64.28 fixed 13.1-64.28
- vendor:citrix netscaler application delivery controller affected >= 14.1, < 14.1-73.41 fixed 14.1-73.41
- vendor:citrix netscaler application delivery controller affected >= 14.1-66.68, <= 14.1-73.41 fixed ?
- vendor:citrix netscaler gateway affected >= 13.1, < 13.1-64.28 fixed 13.1-64.28
- vendor:citrix netscaler gateway affected >= 14.1, < 14.1-73.41 fixed 14.1-73.41

## How to check

Check the NetScaler config (ns.conf) for 'add authentication samlAction' (SAML SP) or 'add authentication samlIdPProfile' (SAML IdP). If either is present and the build is older than the fixed version, you are exposed. Look for repeated nsaaad crashes or Pitboss reboots, and SAML auth log entries with shell commands in the username.

## Fix

Upgrade to NetScaler ADC/Gateway 14.1-73.41 or later, or 13.1-64.28 or later 13.1; ADC 14.1-FIPS 14.1-73.41 FIPS or later; ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.282 or later. Citrix also offers Global Deny Lists for known malicious IPs as an interim measure only. Secure Private Access Hybrid NetScaler instances need the same upgrade.

## Timeline

- 2026-10-23T19:11:50+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-88779
- 2026-10-23T21:36:03+00:00 analyst — Read Citrix CTX697174 (primary), BleepingComputer, CISA alert. Exploited zero-day, KEV 2026-10-04; possible RCE reported by researchers but not confirmed by Citrix. No public PoC link found. No X/Bluesky search done.
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-88779

## Documents

- [advisory] Citrix bulletin CTX697174 CVE-2026-88779 https://support.citrix.com/external/article/CTX697174/citrix-netscaler-adc-and-citrix-netscale.html
- [discussion] BleepingComputer: Citrix patches NetScaler SAML zero-day https://www.bleepingcomputer.com/news/security/citrix-patches-netscaler-saml-zero-day-exploited-in-attacks/
- [mentions] CISA alert: Citrix NetScaler zero-days https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway

## From the sources

Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_