TL;DR: A memory overflow in NetScaler ADC/Gateway can cause denial of service on deployments that use SAML with Gateway/AAA. Citrix has observed targeted attacks. It's CVSS 4.0 8.7 (not 9+) and is included because it's exploited and in KEV. (NetScaler blog, KEV)
| Item | Detail | Source |
|---|---|---|
| CVE / severity | CVE-2026-88779, CWE-119, CVSS 4.0 8.7 | NetScaler |
| Exploitation | "Citrix has observed targeted attacks on unmitigated NetScaler deployments" | NetScaler |
| KEV | dateAdded 2026-10-04, dueDate 2026-10-07 | KEV |
| Preconditions | Gateway/AAA vserver with add authentication samlAction (SP) or samlIdPProfile (IdP) |
NetScaler |
| Fixed | 14.1-73.41; 13.1-64.28; 14.1-73.41 FIPS; 13.1-37.282 FIPS/NDcPP | NetScaler |
| Mitigation | Global Deny List signatures (v24+) via NetScaler Console | NetScaler |
Post-install impact
No confirmed breakage found. Re-upgrade note: if you upgraded for CVE-2026-88771 through 88778 and meet the SAML preconditions, Citrix says to upgrade again to the 88779 builds. (NetScaler)
Last verified 2026-10-15Report an error: contact@moonsec.ai