Citrix confirmed that attackers exploited two NetScaler vulnerabilities on unmitigated deployments. A newer SAML-related issue is separate: the September fixes do not address it, and administrators should follow Citrix’s latest guidance for SAML-configured appliances. As of October 4, 2026, Citrix has also published a separate bulletin for CVE-2026-88779, a SAML-related memory-overflow flaw.
What happened, and which issue is being exploited?
There are two developments to distinguish. In a September 27, 2026 bulletin, Citrix said it had observed exploitation of CVE-2026-88771 and CVE-2026-88772 on deployments that had not been mitigated. Those are two of eight vulnerabilities covered by that bulletin.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Citrix NetScaler MPX 7500/9500 (8x10/100/1000Base-T Copper Ethernet Ports) with 320GB Hard Disk... | $399.99 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
Separately, government advisories in early October described a newly identified issue affecting NetScaler deployments configured for SAML authentication. The Australian Cyber Security Centre (ACSC) and Canadian Centre for Cyber Security say it is separate from CVE-2026-88771 and CVE-2026-88772; Canada says the September fixes do not remediate it. The ACSC warned that a remote attacker exploiting the SAML issue could cause system crashes or denial of service, with potential for exploitation. That warning does not establish that every detail of the newer issue is the same as the vulnerability in Citrix’s October 4 bulletin.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchOn October 4, Citrix published a bulletin for CVE-2026-88779, describing a memory overflow that can cause denial of service when an appliance is configured as a SAML service provider (SP) or identity provider (IdP). Citrix assigns it a CVSS v4.0 base score of 8.7. Treat the vendor bulletin and the agencies’ warning as related SAML security developments, but do not infer from the bulletin alone that it confirms the full scope or exploitation details described by the agencies.
#1 Best Overall
- Citrix NetScaler MPX 7500/9500 (8x10/100/1000Base-T copper Ethernet ports)
Which September vulnerabilities apply to a deployment?
The September bulletin covers eight issues with different configuration requirements. Citrix’s CVSS v4.0 base scores below are vendor-published severity ratings, not an independent assessment of risk to a particular appliance.
| CVE | Issue and required condition | Citrix CVSS v4.0 base score |
|---|---|---|
| CVE-2026-88771 | Improper input validation that can allow an unauthenticated attacker to execute arbitrary commands remotely. Citrix says all NetScaler ADC and Gateway deployments are affected; no additional feature or setting is required. | 9.5 |
| CVE-2026-88772 | Memory overflow that can lead to remote code execution or denial of service when DTLS is enabled. Citrix says DTLS is enabled by default on VPN virtual servers. | 9.5 |
| CVE-2026-88773 | HTTP request smuggling; an HTTP configuration is required. | 9.3 |
| CVE-2026-88774 | Feature policy bypass involving HTTP URL-based expression usage. | 7.0 |
| CVE-2026-88775 | Memory overflow that can cause unpredictable behavior or denial of service; requires a Gateway or AAA virtual-server configuration. | 8.8 |
| CVE-2026-88776 | Memory overflow that can cause unpredictable behavior or denial of service; requires an Oracle-type load-balancing virtual server. | 8.8 |
| CVE-2026-88777 | Memory overflow that can cause unpredictable behavior or denial of service; requires the specified LB/CS or CGNAT-LSN/NAT64 configuration and a non-HTTP Layer 7 protocol feature. | 8.8 |
| CVE-2026-88778 | TCP initial sequence number prediction; TCP configuration is required. Citrix points affected deployments to an Enhanced ISN configuration change. | 8.8 |
The configuration requirements matter when assessing exposure: the September bulletin says CVE-2026-88771 affects all deployments, while several other issues depend on specific features or virtual-server configurations. Use Citrix’s per-CVE checks and remediation notes to determine what applies to a particular appliance.
Which fixed NetScaler builds should administrators use?
The fixed build depends on the bulletin and the release train. The September fixes for CVE-2026-88771 through CVE-2026-88778 are not a substitute for the newer SAML-related fix listed in Citrix’s October 4 CVE-2026-88779 bulletin.
| Product or release train | September CVEs 88771–88778 | CVE-2026-88779 SAML bulletin |
|---|---|---|
| NetScaler ADC and Gateway 14.1 | 14.1-73.37 and later | 14.1-73.41 and later |
| NetScaler ADC and Gateway 13.1 | 13.1-64.23 and later 13.1 releases | 13.1-64.28 and later 13.1 releases |
| ADC 14.1-FIPS | 14.1-73.37 FIPS and later | 14.1-73.41 FIPS and later |
| ADC 13.1-FIPS and 13.1-NDcPP | 13.1.37.279 and later | 13.1-37.282 and later |
These versions are those listed in Citrix’s respective bulletins as of October 4, 2026. Check the current Citrix advisory for the appliance’s exact product, release train, and applicable build before making a change; version guidance can change. The CVE-2026-88779 bulletin applies to customer-managed appliances and says Citrix-managed cloud services and Adaptive Authentication are updated by Cloud Software Group.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should administrators check for the SAML issue?
Review whether the appliance is configured to act as a SAML SP or IdP, then use Citrix’s current mitigation instructions. Citrix’s CVE-2026-88779 bulletin identifies these configuration checks:
- For a SAML SP, look for
add authentication samlAction. - For a SAML IdP, look for
add authentication samlIdPProfile.
The ACSC’s October 3 update and the Canadian Cyber Centre’s guidance recommend reviewing SAML deployments and monitoring for abnormal activity. Do not assume that installing a September bulletin’s fixed build resolves the separate SAML issue.
What to do if an appliance may have been compromised
Patch status alone cannot establish whether an attacker gained access before remediation. The Canadian Cyber Centre recommends prioritizing Internet-facing systems, preserving evidence where feasible, and investigating for signs of compromise and persistence.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute- Inventory and remediate. Record appliance versions and configurations, check the relevant per-CVE preconditions, and apply the applicable fixed release from each bulletin after verifying current Citrix guidance.
- Preserve evidence before disrupting it, when feasible. Retain appliance, remote syslog, and NetScaler Console logs, along with other available forensic evidence.
- Look beyond the appliance’s patch level. Examine running processes, network connections, startup scripts, scheduled tasks, web application directories, and crash-dump locations. Correlate findings with firewall, DNS, authentication, endpoint, and other telemetry.
- Use available detection and support. The Canadian Cyber Centre recommends NetScaler Console IOC detection and contacting Citrix or an authorized support provider as appropriate.
- Address possible persistence and exposed credentials. Canada warns that persistence may remain after patching if exploitation succeeded. Potentially affected operators should consider credential, session, and certificate actions, and rebuilding from trusted software and a known-good configuration in line with vendor guidance.
Why the September patches and SAML response must be tracked separately
The September bulletin includes vulnerabilities with different prerequisites, including two for which Citrix confirmed observed exploitation on unmitigated deployments. The early-October SAML warning is a separate development, and Canada explicitly says the September fixes do not remediate it. Citrix’s October 4 CVE-2026-88779 bulletin provides its own affected conditions and fixed builds. Administrators should therefore track remediation against each applicable bulletin rather than treating one upgrade as proof that every NetScaler issue—or any earlier compromise—has been resolved.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
