Exploited NetScaler SAML zero-day forces a second upgrade after the September patch
CVE-2026-88779 crashes NetScaler ADC and Gateway appliances configured as a SAML service provider or identity provider. Exploited before the fix, on CISA KEV since October 4, fixed in 14.1-73.41 and 13.1-64.28.
Cloud Software Group published bulletin CTX697174 on October 3 for CVE-2026-88779, a memory overflow (CWE-119, CVSS v4.0 8.7) in NetScaler ADC and NetScaler Gateway that Citrix rates as denial of service. It is reachable only on appliances configured as a SAML service provider (add authentication samlAction) or identity provider (add authentication samlIdPProfile). Citrix said it had observed targeted attacks on unmitigated deployments, and CISA added the flaw to its KEV catalog on October 4 with an October 7 deadline. Fixed builds are 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS and 13.1-37.282 FIPS/NDcPP. Appliances upgraded to 14.1-73.37 or 13.1-64.23 in late September for the exploited CVE-2026-88771 and CVE-2026-88772 (bulletin CTX697096) needed a second upgrade. Citrix credits JPMorgan Chase, Bishop Fox and watchTowr, and watchTowr says it reproduced the bug.
Why it matters
Administrators on 14.1-73.37 logged SAML login attempts whose usernames carried shell commands to download and run a payload, followed by nsaaad crashes and forced reboots, and Kevin Beaumont reported a downloaded malware binary running on one honeypot. Citrix says it found no impact on data integrity, and no one has publicly confirmed code execution through this flaw. Plan as if it could get there: on an IdP-mode appliance, code execution exposes the signing key every relying party trusts. Full details are in our CVE-2026-88779 brief.
This fix did not close the SAML surface. On October 8 Citrix disclosed CVE-2026-107406, a CVSS 9.5 overflow that still affects IdP-mode builds through 14.1-73.41 and 13.1-64.28, so the floor is now 14.1-73.46 and 13.1-64.29.
Source: BleepingComputer
Related on Start with Identity
- BlogBeyondTrust Remote Support zero-day let ARMORY CASTLE dump the credential vault
CVE-2026-102764, a CVSS 9.3 flaw in self-hosted BeyondTrust Remote Support through 26.2.3, was exploited as a zero-day by the China-nexus group ARMORY CASTLE. M
- BlogCisco ISE authentication bypass, CVSS 10, was exploited before the patch
CVE-2026-76460 lets an unauthenticated attacker bypass Cisco Identity Services Engine's management interface through an API endpoint and run commands as root. C
- BlogFortinet's January SSO bypass hit boxes already patched for December's SAML bug
CVE-2026-24858 is the follow-on FortiCloud SSO SAML bypass. Devices patched for CVE-2025-59718 and 59719 were still exploitable. Actively exploited. CISA guidan
- CVEFortinet follow-on SSO SAML bypass after the 59718 patch
A second FortiCloud SSO SAML bypass that hits devices already patched for CVE-2025-59718 and CVE-2025-59719. Actively exploited. CISA guidance 28 January 2026.
- CVEIvanti Connect Secure authentication bypass by spoofed header, exploited as a zero-day
One crafted X-DSCGI-PATH header lets an unauthenticated attacker past Ivanti Connect Secure's login and into command execution. Exploited since early October 20
- CVEBeyondTrust Remote Support zero-day, from file upload to the whole credential vault
An origin-validation flaw in self-hosted BeyondTrust Remote Support through 26.2.3 let ARMORY CASTLE plant a web shell, export every vaulted admin credential, a