Citrix says CVE-2026-88779 can cause denial of service on NetScaler ADC and Gateway appliances configured as a SAML service provider (SP) or identity provider (IdP). Customer-managed appliances should be upgraded to the fixed build for their release branch and edition; Citrix’s bulletin does not describe a separate workaround. The advisory was initially published on October 3, 2026, so check Citrix’s current security bulletin for updates before acting.
What CVE-2026-88779 does
Citrix classifies CVE-2026-88779 as a memory-overflow vulnerability that can lead to denial of service. Its bulletin rates the issue High and gives it a CVSS v4.0 base score of 8.7. The published vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N; it indicates high availability impact and no confidentiality or integrity impact. The bulletin does not characterize the issue as data theft or remote code execution.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Citrix NetScaler MPX 7500/9500 (8x10/100/1000Base-T Copper Ethernet Ports) with 320GB Hard Disk... | $399.99 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
How to check whether an appliance meets the exposure condition
The stated precondition is that NetScaler ADC or Gateway is configured in either SAML role. Citrix identifies these configuration statements as indicators:
add authentication samlAction— SAML service provider (SP).add authentication samlIdPProfile— SAML identity provider (IdP).
Inspect the relevant appliance configuration, then identify the appliance’s release family and edition to select the corresponding fixed build. Finding either statement indicates the stated configuration condition; it does not establish that the appliance was attacked.
#1 Best Overall
- Citrix NetScaler MPX 7500/9500 (8x10/100/1000Base-T copper Ethernet ports)
Secure Private Access Hybrid
Citrix also calls out Secure Private Access Hybrid deployments that use NetScaler instances. Those instances should be upgraded to the recommended builds below.
Which NetScaler build fixes CVE-2026-88779?
Citrix lists these fixed thresholds. “Or later” means a build at or above the threshold in the same release family and edition.
| Release family and edition | Fixed threshold |
|---|---|
| 14.1 standard | 14.1-73.41 or later |
| 13.1 standard | 13.1-64.28 or later |
| 14.1 FIPS | 14.1-73.41 FIPS or later |
| 13.1 FIPS / NDcPP | 13.1-37.282 or later |
Citrix considers versions before the applicable threshold affected and urges affected customers to install the relevant updated version as soon as possible. Do not substitute the standard-edition threshold for a FIPS or NDcPP appliance: choose by both branch and edition.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What mitigation does Citrix recommend?
For customer-managed NetScaler ADC and Gateway, the bulletin’s remediation is to upgrade to the relevant fixed firmware. It does not list a temporary workaround. Reviewing SAML configuration helps determine whether the stated condition applies, but configuration review is not a replacement for patching an affected appliance.
The bulletin says Citrix-managed cloud services and Citrix-managed Adaptive Authentication receive the necessary updates from Cloud Software Group. That managed-service statement does not remove the upgrade responsibility for customer-managed appliances.
Does the configuration check show that an appliance was exploited?
No. The configuration statements identify SAML roles, not attack activity. Citrix’s reviewed bulletin does not state whether exploitation has been observed and does not provide indicators of compromise. Exploitation status is therefore unconfirmed from that bulletin; consult Citrix’s current security bulletin and support updates for any later status information.
Is this the same as CVE-2026-8451?
No. CVE-2026-8451 is a separate Citrix SAML issue: its bulletin describes insufficient input validation leading to memory overread when NetScaler is configured as a SAML IdP. CVE-2026-88779 is a memory overflow that can cause denial of service and applies when NetScaler is configured as either an SP or IdP. Use the CVE-2026-88779 bulletin for this vulnerability’s build thresholds.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
