# Exploited NetScaler SAML zero-day forces a second upgrade after the September patch

Source: https://startwithidentity.com/blog/2026-10-03-exploited-netscaler-saml-zero-day-forces-second-upgrade-after-september-patch/
Last updated: 2026-10-16
License: content by Start with Identity. Cite the source URL.

---

Cloud Software Group published bulletin CTX697174 on October 3 for CVE-2026-88779, a memory overflow (CWE-119, CVSS v4.0 8.7) in NetScaler ADC and NetScaler Gateway that Citrix rates as denial of service. It is reachable only on appliances configured as a [SAML](https://startwithidentity.com/glossary/saml/) service provider (`add authentication samlAction`) or identity provider (`add authentication samlIdPProfile`). Citrix said it had observed targeted attacks on unmitigated deployments, and CISA added the flaw to its KEV catalog on October 4 with an October 7 deadline. Fixed builds are 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS and 13.1-37.282 FIPS/NDcPP. Appliances upgraded to 14.1-73.37 or 13.1-64.23 in late September for the exploited CVE-2026-88771 and CVE-2026-88772 (bulletin CTX697096) needed a second upgrade. Citrix credits JPMorgan Chase, Bishop Fox and watchTowr, and watchTowr says it reproduced the bug.

## Why it matters

Administrators on 14.1-73.37 logged SAML login attempts whose usernames carried shell commands to download and run a payload, followed by `nsaaad` crashes and forced reboots, and Kevin Beaumont reported a downloaded malware binary running on one honeypot. Citrix says it found no impact on data integrity, and no one has publicly confirmed code execution through this flaw. Plan as if it could get there: on an IdP-mode appliance, code execution exposes the signing key every relying party trusts. Full details are in our [CVE-2026-88779 brief](https://startwithidentity.com/cves/cve-2026-88779/).

This fix did not close the SAML surface. On October 8 Citrix disclosed [CVE-2026-107406](https://startwithidentity.com/blog/2026-10-09-netscaler-saml-memory-overflow-cvss-9-5-hits-idp-and-sp-configs/), a CVSS 9.5 overflow that still affects IdP-mode builds through 14.1-73.41 and 13.1-64.28, so the floor is now 14.1-73.46 and 13.1-64.29.

Source: [BleepingComputer](https://www.bleepingcomputer.com/news/security/citrix-patches-netscaler-saml-zero-day-exploited-in-attacks/)