CVE-2026-88779NetScaler SAML memory overflow exploited as a zero-day

What broke

Cloud Software Group published bulletin CTX697174 on October 3, 2026 for CVE-2026-88779 (CVSS v4.0 8.7, CWE-119), a memory overflow in NetScaler ADC and NetScaler Gateway that the vendor classifies as denial of service. It is only reachable when the appliance is configured for SAML: as a service provider (add authentication samlAction) or as an identity provider (add authentication samlIdPProfile).

Affected: 14.1 before 14.1-73.41, 13.1 before 13.1-64.28, 14.1 FIPS before 14.1-73.41 FIPS, and 13.1 FIPS and NDcPP before 13.1-37.282. Secure Private Access hybrid deployments that use NetScaler are also affected. Citrix said it had observed targeted attacks on unmitigated deployments, and CISA added the flaw to its KEV catalog on October 4 with an October 7 deadline. JPMorgan Chase, Bishop Fox and watchTowr are credited.

The builds that fixed the exploited CVE-2026-88771 (command execution) and CVE-2026-88772 (memory overflow) under bulletin CTX697096, 14.1-73.37 and 13.1-64.23, are still vulnerable to this one.

Why it matters

The vendor and KEV entry describe a crash, not a takeover. Field reports go further: administrators on 14.1-73.37 logged SAML logins whose usernames carried shell commands to fetch and run a payload, followed by nsaaad crashes, and one researcher found a downloaded malware binary on a honeypot. Code execution through this CVE is unconfirmed. If it holds, an appliance acting as the identity provider hands over the signing key every relying party trusts, and forged assertions keep working after the patch.

Even as a pure DoS, knocking the IdP or gateway offline stops every federated login behind it. It follows the August CVE-2026-19490 authentication bypass, which on current builds also needs SAML configured on a Gateway or AAA virtual server.

What to do

• Skip to 14.1-73.46 or 13.1-64.29 or later. CVE-2026-107406, disclosed October 8, still affects IdP-mode builds through 14.1-73.41 and 13.1-64.28.
• Grep running configs for samlAction and samlIdPProfile to size exposure.
• Search authentication logs for usernames containing shell syntax and for nsaaad crash and reboot sequences; preserve evidence before upgrading.

After you patch

• If an IdP-mode appliance shows exploitation signs, rotate its SAML signing certificate and update metadata at every relying party.
• Terminate active AAA and ICA sessions after the upgrade.

Sources

• NVD: CVE-2026-88779
• NetScaler bulletin CTX697174
• CISA Known Exploited Vulnerabilities catalog
• BleepingComputer, October 4, 2026