Citrix has released emergency security updates for CVE-2026-88779, a high-severity memory overflow vulnerability in Citrix NetScaler ADC and NetScaler Gateway that has been exploited in the wild as a zero-day. The flaw affects only appliances configured as a SAML Service Provider (SP) or SAML Identity Provider (IdP). Affected products are NetScaler ADC and NetScaler Gateway, NetScaler ADC FIPS before 14.1-73.41 FIPS, and NetScaler ADC FIPS and NDcPP before 13.1-37.282. Secure Private Access hybrid deployments are also affected. Citrix has observed targeted attacks on unmitigated deployments, and exploitation also hit appliances patched only days earlier for CVE-2026-88771 and CVE-2026-88772. No threat actor or named malware family has been linked to the activity. CISA has added CVE-2026-88779 to its Known Exploited Vulnerabilities (KEV) catalog and directed federal agencies to remediate by October 7, 2026.

The vulnerability is classified as Improper Restriction of Operations within the Bounds of a Memory Buffer and resides in the appliance's SAML authentication handling. The vulnerable code is reachable only when the appliance is configured as a SAML SP through the add authentication samlAction command or as a SAML IdP through the add authentication samlIdPProfile command. Exposure therefore depends on configuration, but it sits directly on the internet-facing authentication surface.

Attackers exploit the flaw remotely, without authentication or user interaction, by sending crafted SAML authentication requests that embed shell commands in the username field to download and execute a payload. These requests crash the nsaaad process repeatedly until the NetScaler Pitboss process reaches its restart limit and reboots the appliance. This explains the unexpected reboots reported by administrators, including on systems running 14.1-73.37. A downloaded binary was observed running on at least one honeypot, where it attempts to plant web shells, survive reboots, and upload the appliance configuration and backups. These behaviors point to code execution and data theft well beyond the denial-of-service impact stated by Citrix.

Repeated crashes take down remote access, SAML single sign-on, and application delivery for every user who depends on the affected appliance. Because NetScaler sits at the network edge and handles authentication for VPN, virtual desktop, and federated web applications, an outage directly disrupts workforce productivity and customer-facing services. Citrix states it has not identified any impact on customer data integrity, but the observed web shells, persistence, and configuration theft suggest the real risk extends to full appliance compromise and exposure of stored credentials, certificates, and keys. With active exploitation, the KEV listing, and a three-day federal deadline, this vulnerability should be a top remediation priority for any organization running SAML-enabled NetScaler appliances.