A new high-severity zero-day affecting Citrix NetScaler ADC and NetScaler Gateway has emerged following the disclosure of two critical remote code execution vulnerabilities in the same product family.
Tracked as CVE-2026-88779, the newly disclosed flaw is a memory overflow vulnerability that can cause Denial of Service (DoS) on NetScaler deployments configured as a SAML Service Provider (SP) or SAML Identity Provider (IdP). Citrix rates the vulnerability 8.7 under CVSS v4.0.
A New Vulnerability in an Already Targeted Platform
The timing makes CVE-2026-88779 particularly significant.
On September 27, Citrix disclosed a broader set of NetScaler vulnerabilities, including CVE-2026-88771 and CVE-2026-88772, both critical vulnerabilities that were already being exploited in the wild. The first allowed remote code execution under the default configuration, while the second involved memory corruption affecting deployments with DTLS enabled.
Security researchers subsequently observed exploitation of those vulnerabilities, including activity involving web shells and attempts to obtain sensitive NetScaler configuration data.
CVE-2026-88779 adds a different risk: availability disruption.
How CVE-2026-88779 Works
Citrix describes the issue as a memory overflow vulnerability leading to Denial of Service. The flaw is associated specifically with NetScaler appliances configured to operate as either a SAML SP or SAML IdP.
The vulnerability is classified under CWE-119, which covers improper restriction of operations within the bounds of a memory buffer.
The CVSS v4.0 vector indicates that the vulnerability is remotely exploitable, requires no privileges or user interaction, and can result in a high impact to system availability.
For companies relying on NetScaler for authentication and application delivery, repeated disruption can have consequences beyond the appliance itself. If authentication services become unavailable, employees and customers may lose access to applications and externally exposed services that depend on the affected infrastructure.
CISA Adds the Flaw to the KEV Catalog
The vulnerability has now been added to the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog, indicating that exploitation has been observed and elevating the urgency for affected organizations.
The development is especially important for U.S. federal agencies operating affected NetScaler infrastructure, where KEV-listed vulnerabilities are subject to mandatory remediation deadlines.
Organizations should therefore treat CVE-2026-88779 as an active security issue rather than a routine vulnerability-management item.
Which NetScaler Deployments Are Affected?
According to Citrix, affected versions include:
- NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.41
- NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.28
- 14.1-FIPS versions before 14.1-73.41 FIPS
- 13.1-FIPS / 13.1-NDcPP versions before 13.1-37.282
The specific precondition is that the appliance is configured as a SAML SP or SAML IdP.
Citrix has released fixed builds and strongly recommends affected customers upgrade as soon as possible.
What Companies Should Do
Companies operating NetScaler ADC or Gateway should prioritize the following actions:
✅ Identify exposed appliances
Inventory internet-facing NetScaler infrastructure and determine which systems use SAML authentication.
✅ Verify affected versions
Check each appliance against Citrix's fixed versions rather than assuming previous emergency patching fully addresses the new vulnerability.
✅ Patch immediately
Upgrade affected systems to the Citrix-recommended builds. CVE-2026-88779 requires newer fixes than those released for the September vulnerabilities.
✅ Review previous compromise indicators
Because CVE-2026-88779 follows confirmed exploitation of other NetScaler zero-days, patching alone should not be treated as proof that an appliance is clean. Companies that were exposed to CVE-2026-88771 or CVE-2026-88772 should review logs, configuration changes, authentication activity and potential web-shell indicators.
✅ Monitor authentication infrastructure
Pay particular attention to unusual SAML activity, repeated service disruptions, unexpected administrative changes and anomalous connections involving NetScaler appliances.
The Bigger Security Picture
The latest NetScaler activity demonstrates how quickly a vulnerable edge appliance can become a broader enterprise security concern.
The initial wave involved remote code execution and potential system compromise. The newly disclosed CVE-2026-88779 introduces a separate availability threat against SAML-enabled deployments, extending the security impact from potential compromise to disruption of authentication-dependent services.
For companies using NetScaler at the edge of their environments, the lesson is straightforward: internet-facing infrastructure must be treated as a high-priority attack surface, especially when multiple vulnerabilities are being actively exploited in the same platform.
Emergency patching, exposure management and post-exploitation hunting should therefore operate together rather than as separate security processes.
