Citrix shipped emergency fixes on 5 October for a NetScaler bug that is being used against real deployments, and the detail that matters is in the precondition. The Hacker News reports that CVE-2026-88779 (CVSS 8.7) is a memory overflow that can knock a NetScaler offline, but only if the appliance is configured as a SAML service provider or SAML identity provider. If your gateway fronts single sign-on for staff, that is probably you.
What is affected
NetScaler ADC and Gateway before 14.1-73.41 and before 13.1-64.28. The FIPS builds have their own cut-offs: 14.1-FIPS before 14.1-73.41, and 13.1-FIPS and 13.1-NDcPP before 13.1-37.282. Citrix describes targeted attacks on unmitigated deployments that lead to denial of service, and says it has seen no impact on the integrity of customer data. Bishop Fox and watchTowr are credited with the report, and watchTowr says it reproduced the flaw within hours of seeing NetScaler honeypot activity. CISA added it to the KEV catalogue on 4 October with a federal patch date of 7 October.
Check the config before you check the version
Two stanzas decide whether you are in scope: add authentication samlAction for the service provider role and add authentication samlIdPProfile for the identity provider role. Pull the running config from each appliance and search for both. An estate of forty NetScalers rarely has forty identical configurations, and the quickest way to a defensible risk list is to separate the ones doing SAML from the ones that are not.
Availability is the damage here
It is easy to wave off a denial of service when the headline CVEs from the last fortnight were web shells. Think about what the box does, though. A NetScaler doing SAML is often the front door to remote access and to half the internal web apps. Take it down repeatedly and nobody logs in, and that is a bad morning during a billing run or a trading window. Citrix itself notes that repeated triggering can mean prolonged unavailability.
The context is also not great. We covered the earlier pair of NetScaler zero-days that were used for web shells and post-exploitation. Anyone who was already probing these appliances has a reason to keep going, and the people who patched for the first pair may be tempted to assume they are covered.
What we would do today
- Inventory every NetScaler, including the forgotten pair in a DR site, and record which have SAML actions or IdP profiles.
- Upgrade to 14.1-73.41, 13.1-64.28 or the matching FIPS build. There is no half-measure listed, so plan the failover window now.
- If you cannot patch tonight, make sure you have a second route for staff to authenticate, and tell the service desk what an outage looks like.
- Watch for appliance restarts and core dumps in the last week. Repeated unexplained crashes on a SAML box were probably not a coincidence.
- Put the appliance on the same patch-clock as your other KEV items, not on the quarterly maintenance cycle.
If you want a second pair of eyes on your edge estate, email sales@halfteck.com.