Actively Exploited Citrix NetScaler Denial-of-Service Vulnerability

Executive Summary

A high-severity vulnerability in Citrix NetScaler ADC and NetScaler Gateway allows unauthenticated remote attackers to trigger a memory overflow, causing denial of service. The flaw affects appliances configured as SAML Service Providers or Identity Providers, potentially disrupting access to critical enterprise applications and services.

Key Details

Affected Platform

Citrix NetScaler ADC and NetScaler Gateway

Attack Surface

Remotely accessible NetScaler appliances configured as SAML Service Providers (SP) or Identity Providers (IdP).

Recommended Action

Immediately apply Citrix security updates, scan for vulnerable appliances, and enforce network segmentation.

Affected Environment

Citrix NetScaler ADC and NetScaler Gateway appliances configured as SAML Service Providers or Identity Providers, including:

NetScaler ADC and Gateway 14.1 before 14.1-73.41
NetScaler ADC and Gateway 13.1 before 13.1-64.28
NetScaler ADC FIPS before 14.1-73.41 FIPS
NetScaler ADC FIPS and NDcPP before 13.1-37.282

Affected deployments support enterprise application delivery, authentication, and secure remote access.

Operational Impact

Successful exploitation can cause denial of service on vulnerable NetScaler appliances, disrupting authentication, application availability, and secure remote access. Organisations relying on affected systems may experience service interruptions and reduced availability of critical business applications.

Technical Root Cause

CVE-2026-88779 is a memory overflow vulnerability that allows unauthenticated remote attackers to trigger denial of service in Citrix NetScaler ADC and Gateway appliances configured for SAML authentication.

Exploitation requires the appliance to be configured as a SAML Service Provider or Identity Provider. Administrators can identify affected configurations by checking for add authentication samlAction or add authentication samlIdPProfile entries.

Recommended Mitigation

Apply the latest Citrix security updates immediately after appropriate testing.
Scan affected environments to identify vulnerable NetScaler appliances.
Enforce least-privilege access across systems and services.
Segment critical networks and isolate internet-facing infrastructure.
Enable exploit protection and detection capabilities.
Conduct regular penetration testing and remediate identified vulnerabilities.

Concerned about your exposure?

Our security experts can help you assess affected systems, validate risk and support a safe remediation plan.

Discuss Your Security Exposure Strengthen Your Threat Detection & Response

Assess your risk

Identify affected systems

Plan remediation

Practical, vendor-aligned guidance

Get expert support

From our 24/7 security team

Stay ahead of emerging threats

Get the latest threat intelligence and security advisories from Smarttech247.

Full Technical Report

Download the complete analysis, including detailed technical findings and references.

Download Full Report (PDF)

References

Citrix Security Advisory

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174

CVE Record

https://www.cve.org/CVERecord?id=CVE-2026-88779

Smarttech247 Threat Intelligence Report

Issue 174 — October 4, 2026