Citrix patches a third NetScaler zero-day in two weeks
CVE-2026-88779 crashes NetScaler ADC and Gateway appliances configured for SAML, and CISA added it to its exploited list a day after Citrix's bulletin went out.
Citrix published a security bulletin on 3 October for CVE-2026-88779, a memory overflow in NetScaler ADC and NetScaler Gateway that hits appliances configured as a SAML service provider or identity provider. CISA added it to the Known Exploited Vulnerabilities catalogue the next day, confirming attackers are using it against unpatched systems.
It’s the third NetScaler zero-day disclosed in under two weeks, after CVE-2026-88771 and CVE-2026-88772 landed on 27 September. This one carries a CVSS v4.0 score of 8.7 and was found through coordination with Bishop Fox and watchTowr. Citrix’s bulletin describes the impact as denial of service: a crafted SAML authentication request crashes the appliance’s authentication service. Fixed builds are out now — 14.1-73.41, 13.1-64.28, and the matching FIPS and NDcPP releases.
Why it matters: NetScaler sits at the network edge, so three exploited zero-days in two weeks means admins who patched for the September bugs need to check versions again. If you run SAML through a NetScaler Gateway or AAA setup, that’s the configuration this one targets.
The caveat: Citrix confirms only a crash, not code execution, but some administrators have reported appliances rebooting unexpectedly even after patching, and researchers are still looking at whether the bug goes further than denial of service.