CVE-2026-88779: Citrix NetScaler Vulnerability Exploited in Targeted Attacks

Citrix has disclosed CVE-2026-88779, a memory overflow vulnerability affecting customer-managed Citrix NetScaler ADC and NetScaler Gateway deployments. The vulnerability can cause denial of service when specific deployment conditions are present.

Citrix says it has observed targeted attacks against unmitigated NetScaler deployments. The company recommends that affected customers review their configurations and install fixed software versions as soon as possible.

The vulnerability was initially published on October 3, 2026, and is classified as CWE-119, which covers improper restriction of operations within the bounds of a memory buffer. Citrix assigns the issue a CVSS v4.0 base score of 8.7.

What is CVE-2026-88779?

CVE-2026-88779 affects NetScaler deployments where particular authentication and access configurations are enabled.

According to Citrix, the issue can lead to denial of service. If the triggering condition occurs repeatedly, the affected service may remain unavailable.

Citrix's analysis indicates that the vulnerability affects service availability. The company said it has not identified an impact on the integrity of customer data.

The important distinction for administrators is that simply running an affected NetScaler version does not by itself establish exposure. The deployment must also meet the vulnerability's configuration preconditions.

SAML configuration is central to exposure

The vulnerability is associated with NetScaler deployments using SAML authentication together with Gateway or AAA functionality.

Administrators should therefore review whether their appliance is configured as either:

• A SAML Service Provider (SP)

• A SAML Identity Provider (IdP)

Citrix provides configuration entries that administrators can use to determine whether these conditions are present:

add authentication samlAction

or

add authentication samlIdPProfile

The official security bulletin confirms that these SAML configurations are the relevant preconditions for CVE-2026-88779.

Which NetScaler versions are affected?

Citrix identifies the following supported versions as affected when the required preconditions apply:

The bulletin applies to customer-managed NetScaler ADC and NetScaler Gateway. Citrix-managed cloud services, including Gateway Service and Citrix-managed Adaptive Authentication, are updated by Citrix.

Citrix has observed targeted attacks

One of the most important aspects of the advisory is that Citrix says it has observed targeted attacks against unmitigated NetScaler deployments.

The attacks described by Citrix can result in denial of service. The company does not state in the advisory that CVE-2026-88779 provides data theft or data-integrity impact.

This distinction matters for incident response. Administrators should focus on both patching and checking whether affected appliances show signs of attack activity.

4

Global Deny List can provide temporary mitigation

Citrix has also released signatures that can be used with the Global Deny List feature as a mitigation while customers assess their environments and prepare for an upgrade.

Citrix says the Global Deny List feature is enabled by default beginning with:

• NetScaler 14.1-60.52

• NetScaler 13.1-63.21

For the mitigation described in the advisory, supported software must fall within specific ranges:

• 14.1: 14.1-73.37 through versions before 14.1-73.41

• 13.1: 13.1-64.23 through versions before 13.1-64.28

The deployment also needs NetScaler Console on-premises with Cloud Connect or the NetScaler Console service, with Virtual patching enabled.

Citrix recommends checking the available AppFW signatures using:

show appfw signatures

The advisory states that the encrypted signature version should be at least v24 for the relevant signature availability.

How administrators can verify the mitigation

Citrix provides an additional CLI check:

stat denylist global AAA_REQUEST

Administrators should review the counters and related statistics, including Last Hit Time, to determine whether the rules are being evaluated.

The mitigation should not be treated as a replacement for upgrading. Citrix explicitly recommends installing a software release containing the fix as soon as possible.

Fixed versions are the recommended remediation

Citrix recommends upgrading affected deployments to the following releases:

• NetScaler ADC and Gateway 14.1: 14.1-73.41 or later

• NetScaler ADC and Gateway 13.1: 13.1-64.28 or later

• NetScaler ADC 14.1-FIPS: 14.1-73.41 FIPS or later

• NetScaler ADC 13.1-FIPS and 13.1-NDcPP: 13.1-37.282 or later

For administrators who already upgraded their NetScaler environments in response to the earlier CVE-2026-88771 through CVE-2026-88778 security bulletin, Citrix says another upgrade is required if the deployment also meets the preconditions for CVE-2026-88779.

This is particularly relevant because the previous NetScaler advisory covered multiple vulnerabilities, including CVE-2026-88771 and CVE-2026-88772, for which exploitation had also been observed.

Additional defensive measures

Citrix recommends that customers continue following their standard incident response procedures if they identify signs of compromise.

The company also points administrators toward several additional defensive measures:

• Review NetScaler configurations against the CVE preconditions.

• Upgrade affected appliances promptly.

• Use NetScaler blocklist functionality to block suspicious IP addresses.

• Review network and perimeter security controls.

• Where appropriate, use firewall rules to block traffic from identified attack sources.

• Continue monitoring for updates from Citrix.

These measures form a defence-in-depth approach around the primary remediation of upgrading the vulnerable appliance.

What enterprises should do now

For organisations operating customer-managed NetScaler infrastructure, the response can be organised into four practical stages:

1. Identify

Determine which NetScaler ADC and Gateway instances are running affected versions.

2. Check configuration

Review whether the appliances are configured as a SAML SP or SAML IdP and whether the Gateway or AAA conditions described by Citrix apply.

3. Mitigate

Where applicable, verify that the Global Deny List signatures and virtual patching controls are available and functioning while the upgrade is being prepared.

4. Upgrade and investigate

Install the appropriate fixed release. If the appliance was exposed and there are signs of malicious activity, follow the organisation's incident response procedures.

Why this vulnerability matters

The announcement highlights a broader operational challenge for organisations running internet-facing infrastructure: vulnerability exposure can depend not only on the software version but also on how specific security and authentication features are configured.

For enterprises, this means vulnerability management needs to combine version inventory, configuration assessment, mitigation controls and timely patching.

CVE-2026-88779 also demonstrates why security advisories should be read beyond their headline severity score. The CVSS 8.7 rating is important, but understanding the actual deployment preconditions is equally important for determining which systems require immediate attention.

Citrix's guidance is clear that the Global Deny List can help reduce exposure, but the recommended remediation remains upgrading to a fixed release.

Bottom Line

CVE-2026-88779 is a high-severity NetScaler memory overflow vulnerability that can cause denial of service under specific SAML-related configurations. Citrix has observed targeted attacks against unmitigated deployments and recommends affected customers upgrade promptly.

Organisations should first establish whether their NetScaler appliances meet the stated preconditions, apply available mitigation where appropriate, and then move to the fixed releases specified by Citrix.