Citrix has released emergency updates for a NetScaler zero-day that attackers have exploited against appliances using SAML authentication. Tracked as CVE-2026-88779, the vulnerability can crash affected systems and interrupt access to services.
The memory buffer flaw affects NetScaler ADC and NetScaler Gateway deployments using SAML authentication with Gateway or AAA functionality. It carries a CVSS severity score of 8.7.
Meanwhile, researchers are investigating evidence of possible remote code execution. Citrix has confirmed denial-of-service attacks, but the broader impact remains under investigation.
Repeated Attacks Can Keep Services Offline
According to Citrix, attackers have targeted deployments that lack protection against the vulnerability. Repeated exploitation can leave affected services unavailable.
The company says its analysis has identified an availability issue without finding an impact on customer data integrity. However, that assessment does not resolve researchers’ separate concerns about possible code execution.
Administrators first reported unexpected reboots on appliances that had already received the previous security updates. Some described similar failures even after rebuilding systems from fresh images.
Several reports identified repeated crashes in the nsaaad authentication process. Eventually, NetScaler’s Pitboss monitoring process reached its restart limit and rebooted the appliance.
New Updates Replace Earlier Security Fixes
Citrix released the following versions to address the NetScaler zero-day:
- NetScaler ADC and Gateway 14.1: 14.1-73.41
- NetScaler ADC and Gateway 13.1: 13.1-64.28
- NetScaler 14.1 FIPS deployments: 14.1-73.41 FIPS
- NetScaler ADC 13.1 FIPS and NDcPP deployments: 13.1-37.282
Organizations that installed earlier updates must upgrade again if their deployments meet the affected configuration requirements.
Administrators can check for SAML service provider configurations containing add authentication samlAction. Alternatively, SAML identity provider configurations may contain add authentication samlIdPProfile.
Citrix also offers Global Deny Lists to block known malicious IP addresses. Nevertheless, the company recommends installing the new updates as soon as possible.
Researchers Examine Possible Code Execution
One administrator investigating crashes found crafted authentication usernames containing commands designed to download and run an external payload.
Those requests appeared immediately before three confirmed authentication-process crash sequences. They also targeted multiple SAML authentication factors.
However, the administrator stressed that the logs demonstrated attempted exploitation and associated crashes. They did not establish that the appliance successfully executed the commands.
Separately, security researcher Kevin Beaumont reported crashes on patched NetScaler 13.1 and 14.1 honeypots receiving requests from multiple IP addresses. He later said one honeypot was running a downloaded malware binary.
That observation raises concerns about an impact beyond service disruption. However, the available reports do not conclusively establish whether CVE-2026-88779 alone enabled the reported malware execution.
Meanwhile, watchTowr Labs says it reproduced the vulnerability after investigating honeypot activity. The company has not released technical details.
CISA Sets October 7 Mitigation Deadline
CISA added CVE-2026-88779 to its Known Exploited Vulnerabilities catalog on October 4. The agency set an October 7 mitigation deadline for Federal Civilian Executive Branch agencies.
The listing reinforces the urgency of addressing the flaw. For affected organizations, the key distinction is that earlier NetScaler patches do not cover this newly disclosed vulnerability.
Citrix’s current guidance calls for another upgrade on deployments that meet the SAML configuration requirements.
0 responses to “Citrix Patches NetScaler Zero-Day as Attacks Disrupt SAML Deployments”