Citrix NetScaler SAML Vulnerability Enables Unauthenticated Remote DoS Attacks

Citrix has released emergency security updates to address a high-severity memory overflow vulnerability in NetScaler ADC and NetScaler Gateway.

This flaw, tracked as CVE-2026-88779, could allow unauthenticated remote attackers to cause persistent denial-of-service conditions.

The vulnerability specifically affects appliances configured for SAML authentication, whether set as a Service Provider (SP) or an Identity Provider (IdP).

Cloud Software Group has assigned a CVSS v4 base score of 8.7 to this issue and categorized it as CWE-119, which refers to improper restriction of operations within the bounds of a memory buffer.

The published vector indicates that this flaw can be exploited over the network with low attack complexity and does not require authentication or user interaction. Its assessed impact is primarily on availability.

Citrix NetScaler SAML Vulnerability

CVE-2026-88779 is relevant only when NetScaler ADC or Gateway is set up to process SAML authentication. Citrix specifies that an appliance meets the vulnerability precondition if its configuration includes either of the following entries:

• `add authentication samlAction` (indicating a SAML SP configuration)
• `add authentication samlIdPProfile` (indicating a SAML IdP deployment)

Organizations utilizing NetScaler Gateway or AAA functions for federated authentication should prioritize patching any externally reachable SAML-enabled appliances.

This memory overflow issue can cause a device or service to crash. If triggered repeatedly, it may disrupt remote-access portals, identity flows, and applications that rely on the NetScaler appliance for authentication and traffic delivery.

Affected Versions and Fixes

Citrix identifies the following vulnerable product branches:

Product branch	Vulnerable before	Fixed release
NetScaler ADC and Gateway 14.1	14.1-73.41	14.1-73.41 or later
NetScaler ADC and Gateway 13.1	13.1-64.28	13.1-64.28 or later
NetScaler ADC 14.1-FIPS	14.1-73.41 FIPS	14.1-73.41 FIPS or later
NetScaler ADC 13.1-FIPS and 13.1-NDcPP	13.1-37.282	13.1-37.282 or later

Citrix strongly urges affected customers to install the appropriate fixed build as soon as possible. NetScaler Console users can identify impacted instances through its CVE Detection workflow and initiate an upgrade from the affected instance view.

The vulnerability has been reported to be exploited in targeted attacks against unmitigated deployments. While Citrix assesses that the flaw primarily affects availability and does not compromise customer data integrity, widespread gateway disruptions can have significant operational impacts, especially for organizations relying on NetScaler for VPN, workforce access, and SSO services.

Teams should also review appliance crash events, unexpected reboots, SAML-related authentication failures, nsaaad service behavior, firewall telemetry, and identity-provider logs for signs of attempted exploitation.

Finally, Citrix acknowledges Bishop Fox and watchTowr’s collaboration in addressing this issue.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.