CVE-2026-88779: Citrix NetScaler SAML memory overflow leading to DoS

CVE-2026-88779 is a Citrix NetScaler ADC and Gateway vulnerability: SAML memory overflow leading to DoS, rated CVSS 4.0 8.7 High. Citrix disclosed it on 3 October 2026 in bulletin CTX697174, crediting Bishop Fox and watchTowr, and says it has observed targeted attacks on unmitigated deployments with no impact on customer data integrity so far. It is the CVE behind the SAML issue Citrix had described without a CVE since 2 October. ^[3]

CVE

CVE-2026-88779

Product

Citrix NetScaler ADC and NetScaler Gateway

Bulletin

CTX697174 ^[3]

Severity

CVSS 4.0: 8.7 High

Exploitation

Exploited in the wild (targeted)

CISA KEV

Yes, added 4 Oct 2026, federal deadline 7 Oct 2026 ^[21]

Disclosed

3 Oct 2026

Fixed builds

14.1-73.41, 13.1-64.28 and FIPS/NDcPP builds

CVE-2026-88779 vulnerability records

Official records for CVE-2026-88779, checked on 5 October 2026. The CVE record was published by the CNA (NetScaler) at 2026-10-04 04:16 UTC; NVD lists it as Undergoing Analysis, carrying the CNA-provided CVSS 4.0 8.7 HIGH (Secondary) and CWE-119. NVD has not scored it independently yet.

• NIST NVD: CVE-2026-88779
• CVE.org record: CVE-2026-88779
• Citrix bulletin CTX697174
• CISA KEV entry: CVE-2026-88779

CVE-2026-88779 timeline

1. Sep 27, 21:30 UTC Official advisory Validated

   CISA adds CVE-2026-88771 and CVE-2026-88772 to KEV

   Both were added on 27 Sep with a federal remediation deadline of 30 Sep. The 21:30 UTC release time comes from the compiled dataset and was not found in the sources checked.

   Dates validated against the KEV catalog feed on 29 Sep.

   Sources: ^[8][21]

2. Sep 30 Official advisory Deadline - upcoming

   Deadline: CISA KEV federal remediation

   Both CVEs were added to KEV on 27 Sep with a due date of 30 Sep, giving US federal agencies three days. The required action is to apply Citrix mitigations under BOD 26-04 and CISA's Forensics Triage Requirements, or stop using the product if mitigations are unavailable; the KEV notes say customers must conduct forensic triage. The KEV entry gives a date only (2026-09-30), no time of day. CISA's directive deadlines are conventionally 11:59 PM U.S. Eastern (23:59 EDT, 03:59 UTC on 1 Oct), and third-party KEV trackers treat the due date the same way, but CISA publishes no official time for KEV due dates - so the deadline was passed by 1 Oct 04:00 UTC at the latest. A deadline, not an event.

   Sources: ^{[21][8][89][91]}

3. Oct 1, 15:22 UTC Research

   Poppelgaard checker v1.9 adds public indicators

   Release 1.9 of the free, read-only CTX697096 checker script adds, among others, Arctic Wolf's nsmon.pl implant, the Unit 42 .deb webshell and more attacker IPs, and tags each attack line as before or after the fix. Its author says a clean result is not proof of a clean appliance.

   Sources: ^[41]

4. Oct 3 Official advisory

   Citrix releases a new responder policy via Support (3 October); not yet in Citrix's public post

   Citrix has released a new responder policy as a mitigation for the SAML issue, distributed through Citrix Support on 3 October. The Poppelgaard checker README describes it and recognises it by behaviour on the appliance: any responder policy whose rule mentions samlauth or doAuthentication, bound to a Gateway/AAA vserver or globally, alongside Citrix's earlier RSP_POL_DROP and community Gotham policies. Citrix's public SAML post does not mention the policy yet and its text has not been published; distribution is through Support (under NDA), which matches Beaumont's reports of a responder policy shared through Support ("the policy citrix gave out doesn't work for me" on Oct 2, "the Citrix support mitigations don't appear to work" on Oct 3). The checker reminds admins to ask Citrix Support for the new policy and verifies whether it is bound - and flags a [CHECK] state where a policy is bound but the Responder feature is disabled, which silently ignores it.

   Sources: ^{[41][2][81][82]}

5. Oct 3 Official advisory

   CVE-2026-88779 assigned: bulletin CTX697174 with new fixed builds; Global Deny List interim mitigation

   Citrix publishes bulletin CTX697174 for CVE-2026-88779 - the CVE behind the SAML issue it had described without a CVE since 2 Oct. Memory overflow, CVSS 4.0 8.7, DoS; Citrix credits Bishop Fox and watchTowr, says it has observed targeted attacks on unmitigated deployments, and has so far found no impact on customer data integrity. Fixed builds are newer than the September ones: 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, 13.1-37.282 FIPS/NDcPP - SAML deployments that upgraded on 27 Sep must upgrade again. Citrix also releases Global Deny List signatures as an interim mitigation for standard (non-FIPS) 14.1 and 13.1 appliances on the September builds, managed through NetScaler Console, and a blog explaining them. Only SAML SP or IdP configurations are affected (the same applicability check as the 2 Oct guidance).

   Sources: ^[3][28][2]

6. Oct 4, 18:52 UTC Official advisory

   CISA adds CVE-2026-88779 to KEV - third exploited NetScaler CVE; federal deadline 7 Oct

   CISA adds CVE-2026-88779 to the Known Exploited Vulnerabilities catalog (catalog version 2026.10.04, released 18:52 UTC), its third NetScaler entry of this campaign after CVE-2026-88771 and CVE-2026-88772 (both 27 Sep). CWE-119, due date 7 Oct 2026, required action: apply mitigations per vendor instructions under BOD 26-04 and CISA's Forensics Triage Requirements (forensicTriage = Yes), or discontinue use of the product if mitigations are unavailable; ransomware use Unknown. The KEV addition confirms the vulnerability is exploited, consistent with Citrix's "observed targeted attacks" wording.

   Sources: ^[21][3]

7. Oct 5, 17:37 UTC Community

   Citrix forum: Console relabels to "NS Asset Delivery"; stat denylist command behaviour after patching (unconfirmed)

   A customer reports in Citrix's CVE-2026-88779 forum thread (unconfirmed, no Citrix reply) two observations after patching to 13.1-64.28: on-prem NetScaler Console now shows "NS Asset Delivery" where it previously showed "Virtual Patching", and the verification command stat denylist global AAA_REQUEST - which worked before - returns "no such resource", although the signature version (v24) and Denylist flag are ON. Relevant to anyone verifying the Global Deny List mitigation with that command. A follow-up comment (04:25 UTC, same customer) offers the customer's own interpretation - that the GDL signatures apply per firmware to the CVEs known for that build, so an empty stat on the patched build is expected - explicitly not a Citrix statement. No IoCs either way. Verify mitigation state through NetScaler Console rather than one CLI command.

   Sources: ^[109]

Questions about CVE-2026-88779

Next steps

• How to detect NetScaler compromise
• Public NetScaler IoCs
• NetScaler remediation and fixed builds

Related pages

• PitScaler overview: Citrix NetScaler zero-days
• NetScaler zero-day timeline
• NetScaler zero-day IoCs
• NetScaler zero-day detection
• NetScaler zero-day remediation
• NetScaler zero-day FAQ
• About PitScaler and its methodology
• CVE-2026-88771: unauthenticated remote code execution
• CVE-2026-88772: DTLS memory overflow leading to RCE
• CVE-2026-88773: HTTP request smuggling
• CVE-2026-88774: feature policy bypass
• CVE-2026-88775: Gateway/AAA memory overflow (DoS)
• CVE-2026-88776: Oracle load-balancer memory overflow (DoS)
• CVE-2026-88777: non-HTTP L7 memory overflow (DoS)
• CVE-2026-88778: TCP initial sequence number prediction

References