Vulnerabilities

The SAML attack that was rebooting patched NetScaler appliances now has a name and a fix. Citrix published bulletin CTX697174 on October 3 for CVE-2026-88779, a memory overflow in NetScaler ADC and NetScaler Gateway rated 8.7 on CVSS v4.0, and said it has seen targeted attacks against unmitigated appliances. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on October 4 and gave US federal civilian agencies until October 7 to deal with it.

You are affected if you run a customer-managed NetScaler that acts as a SAML service provider or identity provider for a Gateway or AAA (authentication, authorisation and auditing) virtual server, on a 14.1 build before 14.1-73.41 or a 13.1 build before 13.1-64.28. That includes appliances already upgraded to 14.1-73.37 or 13.1-64.23 for CVE-2026-88771 and CVE-2026-88772 last month. If you followed our October 4 post and found SAML configured, the fixed build is the step you were waiting for.

How it works

When a NetScaler handles SAML (Security Assertion Markup Language) single sign-on, its authentication daemon, nsaaad, parses SAML messages and login data sent by the user's browser before anyone has logged in. Citrix classifies the bug as CWE-119, a write or read outside the bounds of a memory buffer, in that handling. A crafted request overflows the buffer and nsaaad crashes.

The CVSS vector spells out the reach: network attack, low complexity, no privileges, no user interaction, and high impact on availability only (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H). Citrix says repeated triggering can keep the service unavailable and that it has found no impact on the integrity of customer data. In practice the crash loop ends in a reboot: administrators reported nsaaad crashing repeatedly until pitboss, the NetScaler watchdog, hit its restart limit and restarted the whole appliance, including appliances already on 14.1-73.37.

Citrix has not published the vulnerable field or request format. watchTowr Labs has reproduced the flaw, and Citrix credits watchTowr and Bishop Fox, but neither has released technical details.

Is it only a denial of service?

Officially, yes. Citrix's bulletin describes a "Memory overflow vulnerability leading to Denial of Service", and the score carries no confidentiality or integrity impact.

Researchers have seen signs of more. Kevin Beaumont found one of his patched NetScaler honeypots running a downloaded malware binary after the crashes started. An administrator described to BleepingComputer, and SecurityWeek also reported, SAML authentication requests with shell commands placed in the username field, built to fetch and run a payload. The logs showed the attempts and the crashes that followed them, but not that the payload ran.

No public proof of concept shows reliable code execution, and Citrix, CISA and watchTowr have not confirmed it. Until one of them does, run the compromise checks below on every in-scope appliance as if attacker commands could have run on it.

What attackers are doing

Exploitation started before the bulletin. Reports of patched appliances rebooting began on Friday, October 2, and Beaumont saw his honeypots on 13.1 and 14.1 crash under requests from several source addresses. Citrix describes the activity as targeted attacks on unmitigated deployments. No one has named the attackers, published a victim count or confirmed which data, if any, was taken.

It is the third NetScaler flaw added to the KEV catalog since September 27, landing while many teams were still cleaning up after CVE-2026-88771 and CVE-2026-88772, and it hits appliances that teams had just marked as fixed.

What to do

1. Confirm whether SAML puts you in scope

Look for add authentication samlAction (the NetScaler as SAML service provider) or add authentication samlIdPProfile (the NetScaler as identity provider) in the running configuration. From the CLI, show authentication samlAction and show authentication samlIdPProfile list them. Secure Private Access hybrid deployments that use NetScaler instances also count. Citrix-managed cloud services, including Gateway Service and Citrix-managed Adaptive Authentication, are patched by Citrix.

2. Keep the evidence before you touch the box

watchTowr's advice is to preserve logs, a support bundle and snapshots before upgrading or rebooting. Copy /var/log/ns.log, /var/log/messages, any nsaaad core files in /var/core and the output of show techsupport off the appliance. An upgrade reboot can wipe exactly what you need later.

3. Upgrade every node

The fixed builds are 14.1-73.41 and 13.1-64.28 for NetScaler ADC and Gateway, 14.1-73.41 FIPS for 14.1-FIPS, and 13.1-37.282 for 13.1-FIPS and 13.1-NDcPP. Upgrade both nodes of each high availability pair and every cluster node. Do not roll back to an older build to stop the reboots, because those builds are open to CVE-2026-88771, which needs no SAML at all.

4. If you cannot upgrade today

Citrix has released signatures for its Global Deny List feature as a stopgap. They work through NetScaler Console with Virtual patching enabled, on appliances already on an intermediate build: 14.1-73.37 up to 14.1-73.41, or 13.1-64.23 up to 13.1-64.28. Citrix says the signature version must be v24 or later. Reports differ on what the signatures match: some describe them as blocking known malicious IP addresses, so treat them as a filter that reduces exposure, not a fix.

5. Check for compromise

Run Citrix's indicator of compromise (IoC) script from NetScaler Console. Its latest version can flag suspicious processes running as the nobody user on clean systems, so review each hit rather than acting on the count. Then look at the appliance yourself:

• ns.log and /var/log/messages for nsaaad exiting, nsaaad reaching its restart limit and pitboss declaring a failure, and for crashes dated before your upgrade.
• AAA and Gateway logs for SAML logins whose username field holds shell commands instead of a name, the pattern administrators reported in the attack requests.
• Firewall and proxy logs for outbound connections from the NetScaler to hosts you do not know, plus new files and running processes on the appliance.

6. If anything looks wrong

Treat the appliance as compromised: build a new instance on a fixed build rather than cleaning the old one, as watchTowr advises, and restore configuration you have reviewed. Rotate the NetScaler admin passwords, the SAML signing certificates and keys held on the box, LDAP and RADIUS bind credentials, and end active Gateway sessions.

Track features in use, not just builds

A NetScaler that was fully patched on September 28 was vulnerable again by October 2. Version-based asset tracking would have marked those appliances green the whole time. Track edge appliances by build and by feature in use, so a bulletin that applies only to SAML deployments gives you a list of hosts within minutes, and alert on daemon crashes and unplanned reboots the same way you alert on failed admin logins.

Our attack surface management work keeps that list of exposed appliances and builds current, and our security operations team can set up alerting on NetScaler crashes, reboots and odd SAML logins. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.

---

Sources: Citrix bulletin CTX697174, CISA KEV alert, watchTowr FAQ on CVE-2026-88779, BleepingComputer, Help Net Security, Techzine, Cybersecurity Dive, SOC Prime, Sophos, DEV Community analysis.