Citrix NetScaler Zero-Day Exploited in the Wild Crashes SAML Authentication Services

What it is

CVE-2026-88779 is a memory overflow (CWE-119) in the nsaaad SAML authentication handler on Citrix NetScaler ADC/Gateway, triggered via crafted network requests to a SAML service provider or SAML IdP configuration.

How it works

Attackers send specially crafted SAML authentication requests to appliances configured with add authentication samlAction (SAML SP) or add authentication samlIdPProfile (SAML IdP). The overflow crashes the nsaaad service; no authentication is required. Repeated triggering keeps the service offline indefinitely.

Preconditions / Affected

• SAML authentication must be enabled (SP or IdP profile configured) on the appliance.
• Vulnerable versions: NetScaler ADC/Gateway 14.1 before 14.1-73.41; 13.1 before 13.1-64.28; 14.1-FIPS before 14.1-73.41; 13.1-FIPS and 13.1-NDcPP before 13.1-37.282.
• Citrix-managed cloud services are not affected, but Secure Private Access Hybrid deployments running vulnerable NetScaler instances are in scope.

What to do

• Upgrade to NetScaler ADC/Gateway 14.1-73.41 or later, or 13.1-64.28 or later (with matching FIPS/NDcPP builds).
• Check appliance configuration for SAML exposure (SP/IdP profiles) to identify at-risk instances.
• Monitor for unexplained nsaaad service crashes or appliance reboots as indicators of compromise.
• Block attacker IP 213.209.159.55, observed in exploitation attempts.

Caveats

Citrix has confirmed targeted in-the-wild exploitation and watchTowr Labs independently reproduced the crash via honeypot activity, but suspicions that the overflow could extend to remote code execution beyond the documented DoS remain unconfirmed by Citrix. This is the sixth NetScaler vulnerability added to CISA KEV in 2026, with a federal remediation deadline of October 7.