You updated NetScaler last week. Good. If SAML runs on it, you are not done.
Fact
The facts: on 4 October 2026 CISA added CVE-2026-88779 to the KEV catalog with a federal deadline of 7 October, a forensic triage requirement and ransomware use marked unknown. The flaw is in Citrix NetScaler ADC and NetScaler Gateway: a memory overflow (CWE-119) that under specific conditions leads to denial of service; CVSS v4.0 8.7. In a blog by the NetScaler Cyber Threat Intelligence team, Citrix says it has observed targeted attacks on unmitigated deployments, that if the condition is triggered repeatedly the service may remain unavailable, and that it has not identified an impact on data integrity. Only customer-managed deployments are affected: 14.1 before 14.1-73.41; 13.1 before 13.1-64.28; ADC FIPS before 14.1-73.41 FIPS; ADC FIPS and NDcPP before 13.1-37.282. Per bulletin CTX697174, the precondition is that the appliance is configured as a SAML SP (the line add authentication samlAction in the configuration) or as a SAML IdP (the line add authentication samlIdPProfile); in the blog Citrix ties the issue to SAML authentication together with Gateway or AAA, and names the bulletin as the authoritative statement. Cloud services that Citrix itself manages are updated by the company. As a mitigation Citrix released signatures through the Global Deny List, but recommends upgrading. If you upgraded with the versions from the bulletin for CVE-2026-88771 through CVE-2026-88778 and the preconditions apply to you, Citrix asks for another upgrade, to the versions for this vulnerability.
What goes down here is the service. Citrix has found no impact on the integrity of the data. But NetScaler is the door people use to get into the company from outside, and while it keeps going down, that door stays shut.
First, see whether it concerns you. In the configuration you look for the two lines from the facts. No SAML, and Citrix's precondition is not met. With SAML, the version decides.
When NetScaler goes down, nobody gets into the company from outside.
The Global Deny List signatures are a bridge. They work through NetScaler Console and only in a narrow window: 14.1 from 73.37 to below 73.41, 13.1 from 64.23 to below 64.28. Citrix presents them as help, while you plan the upgrade.
Upgraded to 14.1-73.37 or 13.1-64.23 and the SAML precondition applies to you? The next version is 14.1-73.41 or 13.1-64.28. CISA's deadline runs out on Wednesday.
Sources
CISA - Known Exploited Vulnerabilities Catalog, CVE-2026-88779, 04.10.2026Citrix - Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88779, CTX697174, 04.10.2026Citrix - Understanding and Addressing CVE-2026-88779 in Citrix NetScaler ADC and Citrix NetScaler Gateway, 04.10.2026The visual is generated code-art, no third-party images.