CVE-2026-88779 is a memory-overflow flaw in SAML processing in Citrix NetScaler ADC and NetScaler Gateway. The reported vendor-stated impact is denial of service, and the flaw applies only to appliances configured with a SAML service provider or identity provider profile. Citrix bulletin CTX697174 was issued October 3, 2026, and CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on October 4, 2026. If you use SAML on a NetScaler, treat this as an urgent patch item. If you do not, the reporting does not place that appliance in scope, but confirm that from the configuration itself. The details below come from secondary analysis, so check Citrix’s bulletin before changing production systems.
Am I affected?
The trigger is a configuration condition, not the product name alone. According to a WorkOS analysis dated October 5, 2026, the affected configurations are:
As an Amazon Associate I earn from qualifying purchases.
- A SAML service provider, created with
add authentication samlAction - A SAML identity provider profile, created with
add authentication samlIdPProfile
To check a running appliance, list both object types on the NetScaler command line:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteshow authentication samlAction
show authentication samlIdPProfileIf both return no entries, the reported trigger is absent from that appliance. Any entry in either list means the appliance falls within the reported scope and should be patched.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
What the flaw does, and what is not established
The reported impact is denial of service caused by a memory overflow during SAML processing. In practice, the affected authentication function can be knocked offline. A Govly event summary notes that this can disrupt services behind an affected authentication gateway, so an outage can block users even though the flaw’s direct effect is availability.
The WorkOS analysis also discusses uncertainty about whether crashes could be used to support other activity. The available reporting does not establish code execution for CVE-2026-88779. Describe the confirmed impact as loss of availability, and treat the possibility of further abuse as an open question rather than a finding.
Fixed builds
The WorkOS analysis lists the fixed builds below. Match the row to the appliance’s release line, then confirm the exact build against Citrix bulletin CTX697174 before deploying.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
| Release line | Fixed build listed in the secondary report | Notes |
|---|---|---|
| NetScaler ADC and Gateway 14.1 | 14.1-73.41 | Standard (non-FIPS) line |
| NetScaler ADC and Gateway 13.1 | 13.1-64.28 | Standard (non-FIPS) line |
| 14.1 FIPS | 14.1-73.41 FIPS | FIPS build, as listed in the report |
| 13.1 FIPS/NDcPP | 13.1-37.282 | FIPS/NDcPP line uses a different build number from the standard 13.1 line |
Why September patching may not be enough
Citrix published fixes for CVE-2026-88771 through CVE-2026-88778 on September 27, 2026. The WorkOS analysis states that those September fixes did not include the later fix for CVE-2026-88779. Administrators who patched in September should not assume they are covered. The table compares the two groups as reported.
| Attribute | CVE-2026-88771 to CVE-2026-88778 | CVE-2026-88779 |
|---|---|---|
| Fix or bulletin date | Citrix fixes published September 27, 2026 | Citrix bulletin CTX697174, October 3, 2026 |
| Affected configuration | Not stated in the secondary report | SAML service provider or identity provider profile |
| Reported impact | Not stated in the secondary report | Denial of service from a memory overflow |
| Fixed build | Fixes published September 27; build numbers not stated in the secondary report | Builds listed in the table above |
| Exploitation reporting | Not stated in the secondary report | KEV listing October 4, 2026; active exploitation reported October 6, 2026 |
Exploitation and the federal deadline
According to reporting, CISA added CVE-2026-88779 to KEV on October 4, 2026, and set October 7, 2026 as the remediation deadline for U.S. federal civilian agencies. That deadline had passed by the time of this article’s October 9, 2026 date. It binds federal civilian agencies only. Private organizations are not subject to it, but the flaw affects them the same way if they run the same SAML configuration.
A Govly event summary dated October 6, 2026 reports active exploitation. It is a secondary summary, not a statement from CISA, so check the KEV entry directly for current status.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
What “PitScaler” and “2.0” mean
“PitScaler” is the label used in reporting on this issue. It has not been confirmed as Citrix’s official name for these vulnerabilities. The available reporting also does not explain the “2.0” suffix, so it is unclear whether it denotes a second wave, a separate issue, or simply a media label. Neither word is an official NetScaler software version. For patching, the identifiers that matter are CVE-2026-88779 and the fixed builds above.
Free tools Windows power users keep installed
One-click scans. No signup required.
Response steps, in order
- Inventory every ADC and Gateway appliance. Record the exact build string of each one and whether it runs a FIPS or NDcPP build.
- Check for SAML objects. Run the two
showcommands in the first section on each appliance. Any entry places that appliance in scope. - Read CTX697174. Confirm the affected builds, fixed builds, and any temporary mitigations in Citrix’s own bulletin. The secondary analysis mentions mitigations, but their current availability and suitability are not verified here, so apply only what the vendor describes.
- Upgrade to the fixed build for the appliance’s branch. Use the matching row from the fixed-builds table.
- Verify service health. After the upgrade, test SAML logins end to end and confirm the gateway still reaches the services behind it.
- Review logs for the period before the upgrade. Look for the signs listed below.
Signs worth investigating
These are leads for incident review. They are not proof that an attacker succeeded.
- Unexplained crashes or restarts of authentication-related processes
- Repeated daemon restarts with no matching change window
- Unplanned reboots, especially during periods of SAML login traffic
- Login failures reported by users of applications behind the gateway, with no configuration change to explain them
If the review finds anything unexplained, escalate it to your incident-response process and preserve logs and crash data before rebuilding or reimaging any appliance. Evidence lost during a rebuild cannot be recovered later.
Background: the 2023 NetScaler web-shell campaign
The CISA advisory “Threat Actors Exploiting Citrix CVE-2023-3519 to Implant Webshells”, dated July 20, 2023, describes threat actors exploiting a different NetScaler flaw to install web shells and attempt lateral movement. It shows what NetScaler compromise can look like, but it does not describe the methods used in the 2026 activity and does not concern CVE-2026-88779.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
