Citrix NetScaler Vulnerability CVE-2026-88779: SAML Zero-Day

Summary

Citrix closed CVE-2026-88779, a memory buffer flaw in NetScaler ADC and NetScaler Gateway. The flaw applies only when the appliance is configured as a SAML SP or a SAML IdP. Customers who already upgraded for CVE-2026-88771 through CVE-2026-88778 must upgrade again if they use SAML. This post follows up on our earlier advisory about CVE-2026-88771 and CVE-2026-88772.

• CVSS v4.0: 8.7 (High)
• Actively exploited: Yes.
• CISA KEV: Added to the catalog on 4 October 2026. The due date for US federal agencies is 7 October 2026.
• Impact: Disputed. Citrix describes a denial of service (DoS). Independent researchers report different findings (see below).
• Remediation: Upgrade to a fixed version. A patch is available.

Which appliances are affected?

The flaw applies only to NetScaler ADC or NetScaler Gateway appliances configured as a SAML SP or a SAML IdP. If the configuration contains either of these lines, the appliance is in scope:

• add authentication samlAction
• samlIdPProfile

Appliances that do not use SAML are not affected by this CVE. Still check the status of the other NetScaler patches published in the same period.

Fixed versions

Citrix states that customers who upgraded for CVE-2026-88771 through CVE-2026-88778 must upgrade again for CVE-2026-88779 if they use SAML.

Disputed impact

Sources do not agree on the impact. This advisory does not take a side; each source is summarised as stated.

• Citrix: Describes the flaw as a denial of service (DoS).
• BleepingComputer: Reports that Kevin Beaumont saw malware running on patched honeypots, and that watchTowr reproduced the flaw.
• Beazley Security Labs: Writes that attackers use the forced reboots to trigger the earlier CVE-2026-88771 log-injection payload, and that it found no code execution on patched devices.

In short: whether the impact is DoS alone or a broader effect combined with the earlier payload is still disputed. The operational result does not change: SAML appliances must move to a fixed version, and compromise hunting is required.

Persistence after CVE-2026-88771 / 88772 (LevelBlue)

According to LevelBlue observations reported by The Hacker News, after exploitation of CVE-2026-88771 and CVE-2026-88772 attackers left these traces:

• Creating a sec_monitor superuser account
• Stealing /flash/nsconfig
• Setting the setuid bit on /bin/sh
• Planting PHP webshells mapped to fake CSS URLs

Patching does not remove these traces. Do not assume the appliance is clean after the update.

What to do now

1. Check whether SAML is used: Look for add authentication samlAction or samlIdPProfile in the configuration. If either is present, the appliance is affected by this CVE.
2. Upgrade to a fixed version: Move to a version in the table above. Even if you already upgraded for 88771–88778, upgrade again if you use SAML.
3. Hunt for backdoors: Check for a sec_monitor account, setuid on /bin/sh, PHP webshells mapped to fake CSS URLs, and unexpected configuration changes.
4. If compromise is found: Treat the appliance as compromised and isolate it. Rotate passwords, certificates and secrets stored in /flash/nsconfig. Review admin accounts. Do not restore blindly from a suspect backup.
5. Check your data protection duties: If personal data was accessed, notification duties may apply. In Turkey, KVKK expects the Personal Data Protection Board to be notified within 72 hours of learning of the breach.

How can Doğa Network help?

Our team can help you check NetScaler versions and SAML configuration, plan the upgrade, hunt for sec_monitor and webshell traces, and rotate credentials after a compromise. Call us on +90 850 888 3642 or email hi@doga.network.

Sources

• Citrix – CTX697174: NetScaler ADC and NetScaler Gateway Security Bulletin
• BleepingComputer – Citrix patches NetScaler SAML zero-day exploited in attacks
• Beazley Security Labs – BSL-A1216
• The Hacker News – Citrix NetScaler post-exploitation (LevelBlue)
• CISA – CISA adds one known exploited vulnerability to catalog (4 October 2026)