Citrix NetScaler Under Active Attack via SAML Zero-Day CVE-2026-88779
Citrix has rolled out emergency security updates to address an actively exploited zero-day flaw affecting NetScaler ADC and NetScaler Gateway appliances, tracked as CVE-2026-88779 with a CVSS v4 score of 8.7. The vulnerability is classified as a memory buffer overflow (CWE-119) that impacts appliances configured either as a SAML Service Provider via `add authentication samlAction` or as a SAML Identity Provider using `add authentication samlIdPProfile`. Administrators first raised alarms over the weekend after observing appliances running recently patched firmware versions—such as NetScaler 14.1-73.37—continuously rebooting due to the `nsaaad` authentication daemon crashing until the internal `Pitboss` process hit its watchdog restart threshold. While Citrix officially characterizes the vulnerability strictly as a denial-of-service issue with no observed data integrity impact, incident handlers and external researchers observed weaponized exploitation attempts passing crafted usernames containing shell commands designed to stage second-stage payloads such as `/v` from remote infrastructure. Independent testing yielded mixed assessments: security firm watchTowr reproduced the flaw as a DoS mechanism that can trigger rapid reboots—possibly chained to accelerate exploitation of previously disclosed vulnerabilities like CVE-2026-88771—while other security researchers observed compromised honeypots executing staged binaries. To remediate the vulnerability, Citrix published patched firmware builds across supported lines, including versions 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, and 13.1-37.282 NDcPP. The vendor has also supplied Global Deny Lists intended to temporarily block known attacking IP addresses, though standard patch application remains mandatory. Due to confirmed active exploitation in the wild, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-88779 to its Known Exploited Vulnerabilities catalog, ordering US civilian federal agencies to apply patches by October 7.
Read more about Citrix NetScaler Under Active Attack via SAML Zero-Day CVE-2026-88779