As of October 7, 2026, the latest NetScaler ADC/Gateway security bulletin identified in Citrix’s official materials is for CVE-2026-88779, first published October 3, 2026. This guide covers that specific vulnerability—not every newly disclosed NetScaler issue. To determine whether an appliance meets the bulletin’s exposure conditions, check both its exact release/build and whether its configuration uses SAML as a service provider (SP) or identity provider (IdP).
How do I check if my NetScaler is vulnerable?
Use the appliance’s version and configuration together. Citrix describes CVE-2026-88779 as a memory overflow vulnerability that can lead to denial of service. Its stated configuration precondition is that NetScaler ADC or NetScaler Gateway is configured as a SAML SP or IdP. Citrix assigns the issue a CVSS v4.0 base score of 8.7; that score does not establish whether a particular appliance is exposed.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Citrix NetScaler MPX 7500/9500 (8x10/100/1000Base-T Copper Ethernet Ports) with 320GB Hard Disk... | $399.99 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
- Record the exact release, build, and variant. Note whether the appliance is on 14.1 or 13.1 and whether it is standard, FIPS, or FIPS/NDcPP. A major-version label alone is not enough.
- Inspect the configuration for SAML indicators. Check
/nsconfig/ns.confor the output ofshow ns runningConfig. Look for the SP or IdP configuration entries described below. - Compare the build with the matching threshold. Use the table in the next section and select the row for the appliance’s branch and variant.
- Keep evidence for both checks. A build in an affected range and a matching SAML precondition are the two relevant findings. If either is unclear, ask the NetScaler administrator or vendor support to confirm before deciding that the appliance is safe.
Citrix’s bulletin describes the configuration check in its CVE-2026-88779 security advisory.
How do I know whether my NetScaler is configured as a SAML SP or IdP?
Inspect the configuration for either of these command patterns:
#1 Best Overall
- Citrix NetScaler MPX 7500/9500 (8x10/100/1000Base-T copper Ethernet ports)
add authentication samlActionindicates a SAML service-provider (SP) configuration.add authentication samlIdPProfileindicates a SAML identity-provider (IdP) configuration.
Citrix identifies /nsconfig/ns.conf and show ns runningConfig as places to inspect. The relevant precondition is met if the appliance is configured as either an SP or an IdP; the bulletin does not require both. If neither pattern is present, that check does not show the stated SAML precondition, but it does not replace checking the appliance’s exact build.
Which NetScaler versions are affected by CVE-2026-88779?
Citrix lists the following affected ranges and fixed thresholds. Match the appliance to its branch and product variant rather than comparing build numbers across rows.
| Appliance branch and variant | Affected builds | Fixed threshold |
|---|---|---|
| NetScaler ADC and Gateway 14.1 | Before 14.1-73.41 | 14.1-73.41 and later |
| NetScaler ADC and Gateway 13.1 | Before 13.1-64.28 | 13.1-64.28 and later 13.1 releases |
| NetScaler ADC FIPS 14.1 | Before 14.1-73.41 FIPS | 14.1-73.41 FIPS and later |
| NetScaler ADC FIPS and NDcPP 13.1 | Before 13.1-37.282 | 13.1-37.282 and later |
These are branch-specific thresholds from the Citrix bulletin. Before scheduling a production upgrade, consult the current bulletin and supported-release guidance for the deployment; a numerically newer-looking build does not by itself establish that a release is supported for a particular installation.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Can NetScaler Console check exposure?
NetScaler Console can provide a useful instance-level version scan, but its Security Advisory feature does not account for feature misconfiguration when identifying a vulnerability. Citrix’s supported-CVEs documentation specifies that identifying CVE-2026-88779 requires a version scan, so a Console result should not substitute for checking whether the SAML SP or IdP configuration is present.
See Citrix’s NetScaler Console CVE detection documentation and the supported CVEs list for details about scans and coverage.
What should I do if my NetScaler is affected?
If the appliance is on an affected build and has either SAML configuration indicator, follow the relevant fixed threshold for its branch and variant. Cloud Software Group urges affected customers to install the relevant updated version as soon as possible. Confirm the target release against the current bulletin and supported-release guidance before changing a production system.
The bulletin applies to customer-managed NetScaler ADC and Gateway, including NetScaler instances in Secure Private Access Hybrid deployments. Citrix says Cloud Software Group upgrades Citrix-managed cloud services and Citrix-managed Adaptive Authentication; customers of those services do not perform the appliance upgrade themselves.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
