# NetScaler SAML memory overflow exploited as a zero-day

Source: https://startwithidentity.com/cves/cve-2026-88779/
Last updated: 2026-10-16
License: content by Start with Identity. Cite the source URL.

---

## What broke

Cloud Software Group published bulletin CTX697174 on October 3, 2026 for CVE-2026-88779 (CVSS v4.0 8.7, CWE-119), a memory overflow in NetScaler ADC and NetScaler Gateway that the vendor classifies as denial of service. It is only reachable when the appliance is configured for [SAML](https://startwithidentity.com/glossary/saml/): as a service provider (`add authentication samlAction`) or as an identity provider (`add authentication samlIdPProfile`).

Affected: 14.1 before 14.1-73.41, 13.1 before 13.1-64.28, 14.1 FIPS before 14.1-73.41 FIPS, and 13.1 FIPS and NDcPP before 13.1-37.282. Secure Private Access hybrid deployments that use NetScaler are also affected. Citrix said it had observed targeted attacks on unmitigated deployments, and CISA added the flaw to its KEV catalog on October 4 with an October 7 deadline. JPMorgan Chase, Bishop Fox and watchTowr are credited.

The builds that fixed the exploited CVE-2026-88771 (command execution) and CVE-2026-88772 (memory overflow) under bulletin CTX697096, 14.1-73.37 and 13.1-64.23, are still vulnerable to this one.

## Why it matters

The vendor and KEV entry describe a crash, not a takeover. Field reports go further: administrators on 14.1-73.37 logged SAML logins whose usernames carried shell commands to fetch and run a payload, followed by `nsaaad` crashes, and one researcher found a downloaded malware binary on a honeypot. Code execution through this CVE is unconfirmed. If it holds, an appliance acting as the [identity provider](https://startwithidentity.com/glossary/identity-provider/) hands over the signing key every relying party trusts, and forged assertions keep working after the patch.

Even as a pure DoS, knocking the IdP or gateway offline stops every federated login behind it. It follows the August [CVE-2026-19490](https://startwithidentity.com/cves/cve-2026-19490/) authentication bypass, which on current builds also needs SAML configured on a Gateway or AAA virtual server.

## What to do

- Skip to 14.1-73.46 or 13.1-64.29 or later. [CVE-2026-107406](https://startwithidentity.com/cves/cve-2026-107406/), disclosed October 8, still affects IdP-mode builds through 14.1-73.41 and 13.1-64.28.
- Grep running configs for `samlAction` and `samlIdPProfile` to size exposure.
- Search authentication logs for usernames containing shell syntax and for `nsaaad` crash and reboot sequences; preserve evidence before upgrading.

## After you patch

- If an IdP-mode appliance shows exploitation signs, rotate its SAML signing certificate and update metadata at every relying party.
- Terminate active AAA and ICA sessions after the upgrade.

## Sources

- [NVD: CVE-2026-88779](https://nvd.nist.gov/vuln/detail/cve-2026-88779)
- [NetScaler bulletin CTX697174](https://support.citrix.com/external/article/CTX697174)
- [CISA Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88779)
- [BleepingComputer, October 4, 2026](https://www.bleepingcomputer.com/news/security/citrix-patches-netscaler-saml-zero-day-exploited-in-attacks/)