New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline

Citrix has issued fixes for a high-severity flaw in NetScaler ADC and NetScaler Gateway, tracked as CVE-2026-88779 (CVSS 8.7), after confirming it was already being abused in targeted zero-day attacks. The bug is a memory overflow that can crash customer-managed appliances configured as a SAML service provider or SAML identity provider, repeatedly triggering it can leave the service permanently unavailable, though Citrix says customer data integrity has not been affected. Fixes ship in NetScaler ADC/Gateway 14.1-73.41+, 13.1-64.28+, plus the corresponding FIPS and NDcPP builds; the flaw was reported by Bishop Fox and watchTowr, the latter noting it reproduced the issue within hours of spotting honeypot probing. This comes on the heels of active exploitation of CVE-2026-88771 and CVE-2026-88772 to deploy web shells and tunneling tools on NetScaler systems, and CISA has now added CVE-2026-88779 to its Known Exploited Vulnerabilities catalog, giving federal agencies until October 7, 2026 to patch.