Citrix shipped emergency firmware updates after confirming that attackers are actively exploiting a newly discovered NetScaler flaw that can knock SAML-based login gateways offline, the company disclosed October 4.
The vulnerability, tracked as CVE-2026-88779, is a memory overflow weakness classified under CWE-119, carrying a CVSS v4.0 score of 8.7. It affects NetScaler ADC and NetScaler Gateway appliances that administrators have configured as a SAML service provider or identity provider — a common setup for organizations using NetScaler to broker single sign-on into internal applications.
How CVE-2026-88779 Disrupts SAML Authentication
Citrix says the primary danger is denial of service: repeated exploitation of the flaw can leave the SAML authentication service unavailable on a targeted appliance. For organizations that route employee or customer logins through NetScaler’s SAML functionality, a successful attack can effectively lock users out of the systems that depend on it.
Researchers are separately examining whether the underlying memory overflow could be pushed further into remote code execution, but Citrix has so far confirmed only the denial-of-service impact. The company has not disclosed how many organizations have been targeted or affected.
A Second NetScaler Zero-Day in Two Weeks
CVE-2026-88779 is a distinct vulnerability from CVE-2026-88771 and CVE-2026-88772 — two other NetScaler zero-days, referred to in security circles by the names WHIPSHOT and SLAPSHOT, that Citrix patched in late September. The newly disclosed flaw surfaced just days after those fixes shipped, meaning NetScaler administrators have now had to respond to two rounds of emergency patching within a span of roughly two weeks.
Citrix has not indicated whether the same attackers are behind both waves of exploitation or whether the appliances compromised in the SLAPSHOT/WHIPSHOT campaign overlap with those now being targeted through the SAML flaw. For security teams managing fleets of NetScaler appliances, the back-to-back disclosures mean that firmware inventories and patch status have to be re-verified twice in the same month rather than once.
Citrix Ships Patched 14.1-73.41 and 13.1-64.28 Builds
To address the new flaw, Citrix released patched builds: NetScaler ADC and Gateway 14.1-73.41, and the 13.1-64.28 branch. The company is urging administrators to upgrade immediately if their appliance is configured as a SAML service provider or identity provider, since that configuration is the precondition for exploitation.
As of this report, the vulnerability has not been added to the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog, though Citrix’s own advisory already confirms targeted, in-the-wild attacks against unmitigated systems.
Why NetScaler Remains a Recurring Target
NetScaler appliances sit at the network edge, brokering authentication and traffic for large enterprise and government networks, which makes them a persistent target for threat actors seeking a foothold without needing to compromise an endpoint first. The appliance’s role as an SSO gateway means that disrupting or exploiting it can have outsized downstream effects — users locked out of dozens of connected applications at once, rather than a single compromised account.
The pace of disclosures this fall — three distinct NetScaler zero-days patched within a matter of weeks — reflects a pattern security researchers have tracked across network-edge appliances more broadly in recent years: vendors such as Citrix, Ivanti, and Fortinet have each faced repeated zero-day campaigns against SSL VPN and SSO gateway products, as these devices sit outside traditional endpoint detection coverage while remaining directly reachable from the internet. Attackers have consistently shown they can pivot quickly from one disclosed flaw to hunting for the next in the same product line, particularly once a vendor’s patch cadence signals where defenders are focused.
For NetScaler administrators, the immediate priority is identifying every appliance configured as a SAML SP or IdP and confirming it has been upgraded to the patched firmware branches. Because Citrix has flagged this as actively exploited rather than a theoretical risk, the window between disclosure and opportunistic scanning by additional threat actors is typically short. Organizations that delayed patching the September WHIPSHOT and SLAPSHOT flaws face compounding exposure if the same infrastructure remains unpatched against this newest SAML-focused vulnerability, which is why many enterprise security teams now treat edge-appliance patch management as a standing priority rather than a periodic maintenance task.
The open question researchers have not yet resolved — whether CVE-2026-88779 can be escalated beyond denial of service into remote code execution — will shape how urgently organizations outside the SAML-configured subset need to respond. Until that analysis is complete, Citrix’s guidance remains narrowly scoped to appliances using SAML authentication, leaving administrators of other NetScaler deployments to monitor for updated advisories rather than treat every instance as equally exposed.
