Exploited NetScaler SAML zero-day forces a second upgrade after the September patch
CVE-2026-88779 crashes NetScaler ADC and Gateway appliances configured as a SAML service provider or identity provider. Exploited before the fix, on CISA KEV since October 4, fixed in 14.1-73.41 and 13.1-64.28.
Cloud Software Group published bulletin CTX697174 on October 3 for CVE-2026-88779, a memory overflow (CWE-119, CVSS v4.0 8.7) in NetScaler ADC and NetScaler Gateway that Citrix rates as denial of service. It is reachable only on appliances configured as a SAML service provider (add authentication samlAction) or identity provider (add authentication samlIdPProfile). Citrix said it had observed targeted attacks on unmitigated deployments, and CISA added the flaw to its KEV catalog on October 4 with an October 7 deadline. Fixed builds are 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS and 13.1-37.282 FIPS/NDcPP. Appliances upgraded to 14.1-73.37 or 13.1-64.23 in late September for the exploited CVE-2026-88771 and CVE-2026-88772 (bulletin CTX697096) needed a second upgrade. Citrix credits JPMorgan Chase, Bishop Fox and watchTowr, and watchTowr says it reproduced the bug.
Why it matters
Administrators on 14.1-73.37 logged SAML login attempts whose usernames carried shell commands to download and run a payload, followed by nsaaad crashes and forced reboots, and Kevin Beaumont reported a downloaded malware binary running on one honeypot. Citrix says it found no impact on data integrity, and no one has publicly confirmed code execution through this flaw. Plan as if it could get there: on an IdP-mode appliance, code execution exposes the signing key every relying party trusts. Full details are in our CVE-2026-88779 brief.
This fix did not close the SAML surface. On October 8 Citrix disclosed CVE-2026-107406, a CVSS 9.5 overflow that still affects IdP-mode builds through 14.1-73.41 and 13.1-64.28, so the floor is now 14.1-73.46 and 13.1-64.29.
Source: BleepingComputer
Related on Start with Identity
- BlogBeyondTrust Remote Support zero-day let ARMORY CASTLE dump the credential vault
CVE-2026-102764, a CVSS 9.3 flaw in self-hosted BeyondTrust Remote Support through 26.2.3, was exploited as a zero-day by the China-nexus group ARMORY CASTLE. M
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- BlogCisco ISE authentication bypass, CVSS 10, was exploited before the patch
CVE-2026-76460 lets an unauthenticated attacker bypass Cisco Identity Services Engine's management interface through an API endpoint and run commands as root. C
- CVEAD FS elevation of privilege exploited as a zero-day
A low-privileged local user on an AD FS server could become administrator on the box that holds the federation token-signing keys. Microsoft saw exploitation be
- CVEF5 BIG-IP APM heap overflow in the OAuth authorization server, exploited as a zero-day
BIG-IP APM configured as an OAuth authorization server had a heap overflow that unauthenticated traffic could turn into remote code execution. CVSS 9.8, exploit
- CVEIvanti Connect Secure authentication bypass by spoofed header, exploited as a zero-day
One crafted X-DSCGI-PATH header lets an unauthenticated attacker past Ivanti Connect Secure's login and into command execution. Exploited since early October 20