A newly discovered memory buffer flaw in Citrix NetScaler ADC and NetScaler Gateway appliances is driving emergency patching efforts across the industry. Tracked as CVE-2026-88779, the vulnerability affects systems running SAML authentication with Gateway or AAA functionality and carries a CVSS score of 8.7. Citrix released fixes early Sunday, but the incident has raised questions about the true scope of the vulnerability beyond the denial-of-service impact the vendor initially disclosed.

Citrix stated in its advisory that it "has observed targeted attacks on unmitigated NetScaler deployments which can lead to Denial of Service." The company added that "If the condition is triggered repeatedly, the service may remain unavailable. Our analysis indicates that this issue affects service availability, and we have not identified an impact on the integrity of customer data."

The vendor released NetScaler ADC and NetScaler Gateway versions 14.1-73.41 and 13.1-64.28 to address the flaw. For FIPS deployments, customers should move to 14.1-73.41 FIPS, while NetScaler ADC FIPS and NDcPP customers on the 13.1 branch require version 13.1-37.282. Citrix is also distributing Global Deny Lists to block traffic from known malicious sources, though the company emphasizes that installing the security updates remains the primary mitigation path.

Organizations can check vulnerability status by verifying whether their appliances have SAML authentication enabled through either of these configurations:

  • Appliance configured as a SAML SP add authentication samlAction
  • Appliance configured as a SAML IdP add authentication samlIdPProfile

Complicating the update cycle, organizations that recently patched NetScaler devices to address CVE-2026-88771 through CVE-2026-88778 must now apply additional updates. Citrix warned that "If you upgraded your NetScaler deployment with one of the updated software releases identified in the security bulletin for CVE 2026-88771 through CVE 2026-88778, and if you have determined that your NetScaler deployment meets the preconditions describe above, please upgrade your deployment again."

Researchers probe remote code execution potential

While Citrix characterizes CVE-2026-88779 as a denial-of-service issue, field observations suggest the vulnerability may enable more severe attacks. NetScaler administrators began reporting unexpected appliance reboots on Thursday, with multiple customers running version 14.1-73.37 experiencing forced restarts even after applying the latest available patches.

Administrators across multiple forums documented similar crash patterns, with the nsaaad process repeatedly failing until the NetScaler Pitboss process hit its restart limit and rebooted the entire appliance. One administrator investigating the incidents on version 14.1-73.37 systems discovered crafted authentication usernames containing shell commands designed to download a payload from IP address 213.209.159[.]55, save it as /v, and execute it. These requests appeared immediately before confirmed nsaaad crash sequences and targeted multiple SAML authentication factors, though the administrator noted that logs showed attempted exploitation and correlated crashes without confirming successful command execution.

Citrix published a security notice on Friday acknowledging a "newly observed issue" related to SAML authentication in customer-managed deployments. The company confirmed the issue differed from previously disclosed NetScaler vulnerabilities and advised affected customers to contact support.

Security researcher Kevin Beaumont reported that patched NetScaler 13.1 and 14.1 honeypots were crashing after receiving requests from multiple source IP addresses. He later discovered that one of his patched honeypots was executing a downloaded malware payload, stating "So on one of the honeypots it's running a downloaded (malware) binary. Both were patched, so new vuln." Beaumont characterized the activity as "being sprayed and prayed" and noted that one honeypot lacked a valid SSL certificate.

Beaumont drew a parallel to CVE-2025-6543, which was initially described as a memory overflow leading to denial-of-service before later attacks demonstrated remote code execution capabilities. He suggested CVE-2026-88779 follows a similar pattern, describing it as a "Memory overflow vulnerability leading to Denial of Service."

Security firm watchTowr Labs confirmed it reproduced the vulnerability after investigating reports of NetScaler honeypot activity, though the researchers have not yet released technical details about their reproduction methods.

On Sunday, CISA added CVE-2026-88779 to its Known Exploited Vulnerabilities catalog, confirming active exploitation and mandating that FCEB agencies complete mitigation by October 7.