Citrix patches NetScaler SAML zero-day exploited in attacks

Citrix has rushed out fixes for CVE-2026-88779, a memory buffer vulnerability in NetScaler ADC and NetScaler Gateway that is already being abused in real-world attacks. The bug affects appliances using SAML authentication through Gateway or AAA features, carries a CVSS score of 8.7, and so far Citrix says it only triggers denial-of-service, though researchers are examining whether it also enables remote code execution. Fixed builds are NetScaler ADC/Gateway 14.1-73.41 and 13.1-64.28, with 14.1-73.41 FIPS and 13.1-37.282 for FIPS/NDcPP customers; notably, even organizations that already patched the earlier CVE-2026-88771 through CVE-2026-88778 zero-days must upgrade again if SAML is configured. Administrators have reported appliance reboots and crash loops tied to the nsaaad process, and researchers including Kevin Beaumont and watchTowr Labs found evidence of malware payloads running on patched honeypots, prompting CISA to add the flaw to its Known Exploited Vulnerabilities list with a remediation deadline of October 7.