Citrix NetScaler flaw exploited; patch SAML-configured appliances

What Citrix confirmed

Citrix classifies CVE-2026-88779 as a memory-overflow vulnerability that can cause denial of service, with a CVSS 4.0 score of 8.7. The vendor lists one configuration precondition: the NetScaler ADC or Gateway appliance must be configured as either a SAML service provider (SP) or identity provider (IdP). Its bulletin applies to customer-managed appliances; Citrix says it updates Citrix-managed cloud services itself. The vendor advisory does not describe this CVE as remote code execution. (Citrix security bulletin)

Active exploitation and later intrusion evidence

Norway’s National Security Authority (NSM) reported active exploitation on October 3 and urged organizations to investigate their NetScaler instances. Its October 4 update says the patch is available and notes that the earlier unauthenticated-code-execution claim came from open-source reporting. (NSM, October 4 update; NSM, October 3 alert)

In an analysis published October 19, Rapid7 described an early-October intrusion into a NetScaler ADC. Rapid7 says its logs and filesystem timestamps correlate attacker-controlled text in an authentication username, repeated nsaaad crashes, a Pitboss reboot, post-reboot crash-handler execution, and a root payload. Its report also documents persistence, web shells, internal tunneling, reconnaissance, and collection of configuration and key material. (Rapid7, October 19)

Rapid7 attributes the observed chain to two different vulnerabilities: it describes CVE-2026-88771 as the pre-authentication log-poisoning/RCE flaw that supplied attacker-controlled command text, and CVE-2026-88779 as a separate SAML-parsing crash that supplied the crash/reboot condition. The reported root execution is evidence about this combined chain; it does not mean CVE-2026-88779 alone is an RCE. Rapid7’s case study concerns an investigated appliance and gives no campaign-wide victim total or actor attribution.

Citrix’s CTX697174 bulletin continues to classify CVE-2026-88779 as a memory-overflow vulnerability leading to denial of service, with a SAML service-provider or identity-provider configuration as a precondition. (Citrix security bulletin)

Check configuration and patch

Inventory customer-managed ADC and Gateway appliances, then inspect saved configuration for SAML SP entries such as add authentication samlAction or SAML IdP entries such as add authentication samlIdPProfile. Update affected appliances to the matching fixed build or a later release in that branch:

• ADC and Gateway 14.1: 14.1-73.41 or later.
• ADC and Gateway 13.1: 13.1-64.28 or later.
• ADC FIPS 14.1: 14.1-73.41 FIPS or later.
• ADC FIPS and NDcPP 13.1: 13.1-37.282 or later.

Because NSM reports active exploitation, review affected instances for suspicious activity as well as upgrading. If an exposed appliance cannot be patched promptly, NSM’s October 3 guidance recommends taking it off the network; if that is not possible, restrict access with geographic blocking or an allowlist. (Citrix fixed-build guidance; NSM recommendations)