NetScaler ADC and Gateway SAML memory overflow: attackers can crash the appliance without an account, exploited in the wild

Who is affected

NetScaler ADC and NetScaler Gateway are network appliances many companies put in front of their internal applications and remote access. Citrix’s bulletin covers only customer-managed appliances; Citrix updates its own managed cloud services itself.

Precondition: Citrix’s blog post says the issue is associated with NetScaler deployments that use SAML authentication in conjunction with Gateway or AAA (authentication, authorization and accounting) functionality; customers who deployed NetScaler as a Gateway or AAA virtual server should check whether SAML authentication actions are configured. To decide, look in the configuration for either of these entries: add authentication samlAction (appliance configured as a SAML SP) or add authentication samlIdPProfile (appliance configured as a SAML IdP). Citrix bulletin CTX697174 states the precondition as the appliance being configured as a SAML SP or SAML IdP, with the same configuration entries to check.

The 14.1-FIPS versions don’t match: Citrix says builds “before 14.1-73.41 FIPS” are affected, meaning 14.1-73.41 FIPS itself is fixed. NVD’s CPE data, however, marks versions up to and including 14.1-73.41 as vulnerable. Going by Citrix’s bulletin, upgrading to 14.1-73.41 FIPS or later is enough, but keep an eye on whether NVD updates its data.

How it works

SAML is a single sign-on standard: the IdP confirms who you are, and the SP accepts that verdict and logs you in. A NetScaler configured for SAML handles SAML-related requests coming from the network.

Citrix describes this flaw as a “memory overflow leading to denial of service” and classifies it as CWE-119 (operations outside the bounds of a memory buffer). In plain terms, while handling certain input the code reads or writes past the memory it should use, and the appliance crashes. The sources we reviewed do not give technical details of the flaw.

• No account needed: the CVSS vector shows a network attack with low complexity, no privileges and no user interaction (AV:N/AC:L/PR:N/UI:N); watchTowr also says an attacker can cut off legitimate users without a valid account.
• Impact: per the press, quoting Citrix, if the condition is triggered repeatedly the service may remain unavailable; Citrix also says it has not found any impact on the integrity of customer data.
• Code execution is disputed: BleepingComputer reports that activity seen by administrators and researchers indicates remote code execution may also be possible, and eSentire calls such reports unconfirmed; per BleepingComputer, watchTowr says it reproduced the flaw but has not disclosed technical details.

Generic example of the CWE-119 weakness class; the actual root cause of CVE-2026-88779 has not been published:

// Copies data using a length taken from outside input, without checking the destination is big enough
memcpy(buf, input, input_len);

The fixed approach:

// Check the length fits in the buffer first; reject the request if it doesn't
if (input_len > sizeof(buf)) {
    return REJECT;
}
memcpy(buf, input, input_len);

Scoring differences: Citrix’s bulletin gives a CVSS 4.0 base score of 8.7, rated High; NVD gives a CVSS 3.1 score of 7.5 with availability-only impact (C:N/I:N/A:H). They use different CVSS versions, and both treat it as an availability-only issue. The 7.5 in this page’s severity field is NVD’s CVSS 3.1 score (the score from nvd@nist.gov marked Primary in the NVD API); the CNA (Citrix) gives CVSS 4.0 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) in the CVE record and bulletin. Both scores are correct; they come from different scorers using different CVSS versions.

Timeline

Further reading

• Zero-day: The Hacker News reports the flaw was exploited in targeted zero-day attacks, meaning before a fix existed; the press quotes Citrix as saying it observed targeted attacks on unmitigated deployments; the Canadian Centre for Cyber Security says Citrix indicates in-the-wild exploitation.
• Malware on a honeypot: researcher Kevin Beaumont reported a downloaded malware binary running on one of his patched honeypots; it is not established that this CVE caused it. Separately, one administrator’s logs showed attempted exploitation and correlated crashes, but did not confirm that commands actually ran.
• Ransomware: KEV lists known ransomware campaign use as Unknown.
• When the flaw was introduced: not stated by the sources.
• Detection rule: per Help Net Security, a threat hunter at Geico shared a SIGMA rule for spotting probing and exploitation attempts (not official).
• Credits: Per the current Acknowledgement in Citrix bulletin CTX697174 (read 2026-10-12), Cloud Software Group thanks JPMorgan Chase, Bishop Fox and watchTowr. (watchTowr’s FAQ mentions only Bishop Fox and watchTowr.)
• Related weakness type: CWE-119.