New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline

Ravie LakshmananOct 05, 2026Zero-Day / Vulnerability

Citrix has released security updates for a high-severity security flaw in NetScaler ADC and Citrix NetScaler Gateway that has been exploited as part of targeted zero-day attacks.

The vulnerability, tracked as CVE-2026-88779, carries a CVSS score of 8.7 out of 10.0.

“CVE-2026-88779 is a memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway that can lead to denial-of-service under specific deployment conditions,” Citrix said. “The issue affects customer-managed NetScaler deployments running affected supported versions when the required preconditions are met.”

For successful exploitation, NetScaler ADC or NetScaler Gateway must be configured either as a SAML service provider (SP) or SAML identity provider(IdP). Customers can check if their NetScaler deployment meets the precondition by reviewing their configuration for entries matching the following –

• SAML SP – add authentication…