CVE-2026-88779CVE-2026-88779: NetScaler ADC and Gateway SAML memory overflow exploited for denial of service

Executive summary

CVE-2026-88779 is a memory overflow (CWE-119, CVSS 4.0 8.7) in NetScaler ADC and NetScaler Gateway that Citrix rates as denial of service. It is only reachable when the appliance is configured as a SAML service provider (add authentication samlAction) or SAML identity provider (add authentication samlIdPProfile). Citrix published bulletin CTX697174 with fixed builds on 2026-10-03 and stated it had observed targeted attacks on unmitigated deployments.

CISA added the flaw to KEV on 2026-10-04 with a federal due date of 2026-10-07. Field Effect and Rapid7 describe crafted SAML traffic crashing the nsaaad authentication service; repeated crashes force an appliance reboot and break VPN, Gateway and SSO logins. Citrix reports no impact on data integrity, and no source reviewed documents session hijacking or memory disclosure for this CVE.

The bug arrived days after the 2026-09-27 patch cycle for CVE-2026-88771 and CVE-2026-88772, so appliances updated to 14.1-73.37 or 13.1-64.23 still need a second upgrade. A follow-on SAML overflow, CVE-2026-107406 (CVSS 9.5, possible RCE), still affects the 88779 fixed builds when configured as SAML IdP; the current minimum builds are 14.1-73.46 and 13.1-64.29.

Threat assessment

Exploitation is remote, unauthenticated and needs no user interaction; CISA's SSVC rates it automatable. The direct impact is loss of availability of remote access and SSO, which is business critical for Gateway deployments. watchTowr, quoted by The Register, suspects the crashes were used deliberately and could speed up exploitation of CVE-2026-88771, but this is a hypothesis, not a documented chain.

Start with Identity reports administrators on 14.1-73.37 who logged SAML login attempts with shell commands embedded in the username, followed by nsaaad crashes, and a researcher-reported malware binary on one honeypot. No source confirms code execution through CVE-2026-88779 itself. SOC teams should treat crash and reboot loops on SAML-enabled appliances as a signal to check for both this CVE and the September RCE flaws.

Timeline

1. 2026-10-08

   Citrix publishes CTX697191 for follow-on SAML overflow CVE-2026-107406; new minimum builds 14.1-73.46 and 13.1-64.29. Source

2. 2026-10-05

   Rapid7 updates its NetScaler zero-day post to include CVE-2026-88779. Source

3. 2026-10-04

   CISA adds CVE-2026-88779 to KEV, federal due date 2026-10-07. Source

4. 2026-10-04

   CVE record published by the NetScaler CNA (CVSS 4.0 8.7, CWE-119). Source

5. 2026-10-03

   Citrix publishes bulletin CTX697174 with fixed builds 14.1-73.41 and 13.1-64.28. Source

6. 2026-10-01

   Reports of repeated NetScaler appliance crashes emerge before public disclosure. Source

7. 2026-09-27

   Citrix discloses CVE-2026-88771 to CVE-2026-88778; the fixed builds 14.1-73.37 and 13.1-64.23 remain vulnerable to CVE-2026-88779. Source

Affected & exposure

NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.41

NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.28

NetScaler ADC 14.1-FIPS before 14.1-73.41 FIPS

NetScaler ADC 13.1-FIPS and 13.1-NDcPP before 13.1-37.282

Secure Private Access hybrid deployments that use NetScaler instances

Only customer-managed appliances configured as SAML SP or SAML IdP; Citrix-managed cloud services and Adaptive Authentication are updated by Cloud Software Group. Reporting (CSO, The Register) places the exposure on Gateway or AAA virtual servers using SAML authentication.

Exploitation in the wild

Citrix (via CSO and The Register): observed targeted attacks on unmitigated deployments; attacks can repeatedly trigger the condition and leave the service unavailable; no impact on data integrity identified; no actor attribution published.

Field Effect: reports of repeated appliance crashes emerged on 2026-10-01, before public disclosure; crafted SAML authentication traffic crashes nsaaad and repeated exploitation reboots the appliance.

Rapid7: repeated attempts crash the SAML service and the sixth crash reboots the appliance; treated as a zero-day exploited before disclosure.

watchTowr reproduced the issue and states a single crafted request can take an appliance offline (The Register). Credits in CTX697174: JPMorgan Chase, Bishop Fox and watchTowr.

CISA KEV entry dated 2026-10-04, ransomware use unknown, forensicTriage flag set to No.

Detection & hunting

Detection focuses on availability symptoms and SAML request patterns that the vendor and researchers describe: nsaaad crashes, Pitboss restart events, unexpected reboots, and bursts of SAML authentication requests, plus anomalous usernames in failed logins. Field names depend on how NetScaler syslog is parsed; validate before use.

index=netscaler sourcetype IN (citrix:netscaler:syslog, syslog)
("nsaaad" AND ("core" OR "crash" OR "exited" OR "restart")) OR ("pitboss" AND ("restart" OR "reboot" OR "died")) OR "System started"
| bin _time span=10m
| stats count values(_raw) as samples by _time host
| where count>=2

index=netscaler OR index=proxy (uri_path="*saml*" OR url="*saml*")
| bin _time span=5m
| stats count dc(uri_path) as paths by _time src_ip dest
| where count>50
| sort - count

Syslog
| where Computer has_any ("netscaler","adc","gateway") or SyslogMessage has "AAA"
| where SyslogMessage has_any ("FAILED_BAD_LOGIN","LOGIN_FAILED")
| where SyslogMessage matches regex @"(\$\{IFS\}|\$\(|`|;\s*(wget|curl|sh)\b|\|\s*sh\b)"
| project TimeGenerated, Computer, SyslogMessage

title: NetScaler repeated authentication daemon crash or reboot
status: experimental
description: Detects nsaaad crashes or Pitboss restart events on NetScaler appliances, documented symptoms of CVE-2026-88779 exploitation against SAML SP/IdP configurations.
references:
  - https://fieldeffect.com/blog/citrix-patches-another-exploited-netscaler-vulnerability
logsource:
  product: citrix_netscaler
  service: syslog
detection:
  keywords_daemon:
    - 'nsaaad'
  keywords_event:
    - 'crash'
    - 'core'
    - 'restart'
    - 'pitboss'
  condition: keywords_daemon and keywords_event
falsepositives:
  - Planned maintenance or upgrades
level: high
tags:
  - attack.impact
  - attack.t1499
  - cve.2026-88779

Mitigation

• Check exposure: search ns.conf for "add authentication samlAction" (SP) and "add authentication samlIdPProfile" (IdP), including appliances already updated in the 2026-09-27 cycle.
• Upgrade to at least 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS or 13.1-37.282 FIPS/NDcPP (CTX697174). Because CVE-2026-107406 still affects these builds in SAML IdP mode, go directly to 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS or 13.1-37.283 FIPS/NDcPP or later (CTX697191).
• Interim: per Citrix as quoted by CSO, on 14.1-73.37 to 73.40 and 13.1-64.23 to 64.27 Global Deny List signatures reduce exposure when virtual patching is enabled; verify with "show appfw signatures". Upgrading remains required.
• Prioritise internet-reachable Gateway and AAA virtual servers using SAML; monitor nsaaad crashes, Pitboss restarts and unexpected reboots (Field Effect).
• Session handling: CTX697174 contains no post-upgrade session-termination commands. If the appliance may also have been exposed to CVE-2026-88771/88772, follow Citrix CTX694799 (steps for a suspected compromised NetScaler) and BOD 26-04 forensic triage for those CVEs.
• Run Citrix's IOC tooling where available, but treat a clean result as non-conclusive (watchTowr via The Register).

Update log

Sources

1. Citrix CTX697174: Security Bulletin for CVE-2026-88779
2. Citrix CTX697191: Security Bulletin for CVE-2026-107406
3. CVE-2026-88779 CVE record (cvelistV5)
4. CISA Known Exploited Vulnerabilities catalog (JSON feed)
5. Rapid7: Zero-day exploitation of Citrix NetScaler ADC and Gateway
6. Field Effect: Citrix patches another exploited NetScaler vulnerability
7. Start with Identity: Exploited NetScaler SAML zero-day forces second upgrade
8. The Register: Citrix NetScaler SAML bug exploited
9. CSO Online: Citrix warns of actively exploited NetScaler flaw