CISA put NetScaler SAML overflow on KEV. Last week's RCE build is still in.

CVE-2026-88779 is unauthenticated DoS if the box is a SAML SP or IdP. 14.1-73.37 is not 14.1-73.41.

RWP Ventures · 2026-10-05 · event 2026-10-04 · 14 min read · priority 9.1

The product is Citrix NetScaler ADC and NetScaler Gateway (customer-managed). The bug is a memory overflow (CWE-119) that Citrix and CISA both describe as denial of service. Citrix’s CNA score is 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. Confidentiality and integrity impact on that vector are None. Availability is High. Attack type is unauthenticated. Precondition is SAML: the appliance must be configured as a SAML service provider or a SAML identity provider.

Do not collapse four facts. They are not the same ticket.

1. This is not last week’s RCE. [28 September Daily Top](/posts/2026-09-28-citrix-netscaler-cve-2026-88771-88772-kev/) and [30 September WHIPSHOT hunt](/posts/2026-09-30-netscaler-whipshot-slapshot/) were CVE-2026-88771 / CVE-2026-88772, CTX697096, floors 14.1-73.37 / 13.1-64.23. CVE-2026-88779 is a new CVE, a new bulletin (CTX697174), and a new floor: 14.1-73.41 / 13.1-64.28 (FIPS 14.1-73.41 FIPS; FIPS/NDcPP 13.1-37.282). Citrix’s own blog, last updated 3 October PDT: if you already installed the 88771–88778 builds and you meet the SAML precondition, upgrade again.
2. SAML is the gate. Default config is not. 88771 needed no extra feature. 88779 needs add authentication samlAction (SP) or add authentication samlIdPProfile (IdP), on Gateway or AAA. A box without those strings is not this CVE. A box with those strings on 73.37 is in.
3. Citrix classifies it as DoS. Treat RCE claims as unproven for this CVE. Citrix: targeted attacks on unmitigated deployments; repeated triggers can keep the service unavailable; “we have not identified an impact on the integrity of customer data.” Beazley Security’s 4 October update: their investigations confirm a DoS; they saw actors try to force reboots so 88771 log injection would fire; appliances patched 27 September no longer execute the injected commands; they found no evidence of code execution on patched systems. Secondary reports that a honeypot later ran a downloaded binary are REPORTED, not a vendor reclassification of 88779 as RCE.
4. The ISO exists. The GDL window is not the close. Unlike [FortiMail CVE-2026-104286](/posts/2026-10-04-fortimail-cve-2026-104286-due/), Citrix has shipped builds. Global Deny List signatures are an interim for the narrow band already on 73.37 / 64.23 but not yet on 73.41 / 64.28. Citrix still says upgrade. A deny-list counter is not forensic triage.

This is the sixth NetScaler row CISA put on KEV in 2026 (catalog: 3055, 8452, 19490, 88771, 88772, 88779). The operator problem this morning is not “another Citrix CVE.” It is a SAML box that took last week’s RCE ISO and is still crashable.

What happened

Sunday 27 September, Citrix published CTX697096 for CVE-2026-88771 through CVE-2026-88778. CISA put 88771 and 88772 on KEV the same day. Operators who could, moved to 14.1-73.37 / 13.1-64.23. Mandiant named WHIPSHOT / SLAPSHOT on 88772 on 29 September. Those tickets did not close.

Friday 2 October, administrators reported reboots on appliances already on those RCE builds. Citrix published a SAML-authentication note. CTX697174 assigns that issue CVE-2026-88779. Citrix credits Bishop Fox and watchTowr.

Saturday 4 October (UTC), CISA added the one-row KEV alert. Catalog freeze 2026.10.04 is the first new version since 2026.10.02.

CTX697174 (High): memory overflow leading to denial of service. Pre-condition: “NetScaler ADC or NetScaler Gateway must be configured as a SAML SP OR SAML IdP.” Affected supported trains:

• ADC and Gateway 14.1 before 14.1-73.41
• ADC and Gateway 13.1 before 13.1-64.28
• ADC FIPS before 14.1-73.41 FIPS
• ADC FIPS and NDcPP before 13.1-37.282

Config check Citrix published:

add authentication samlAction

or

add authentication samlIdPProfile

Citrix-managed cloud (Gateway Service, Citrix-managed Adaptive Authentication) is out of the customer bulletin. Citrix says it upgrades those itself. Customer-managed appliances, including any NetScaler instance used in a hybrid design, stay on the customer.

Interim, not the fix. Citrix released Global Deny List signatures. Prerequisites they state: NetScaler Console (on-prem with Cloud Connect, or Console service); “Virtual patching” Enabled; software in 14.1 ≥ 14.1-73.37 and < 14.1-73.41 or 13.1 ≥ 13.1-64.23 and < 13.1-64.28; show appfw signatures Encrypted Version at least v24; stat denylist global AAA_REQUEST to see whether the rule is hitting. Citrix: the signatures can help; upgrade anyway.

Why it matters

Last week’s NetScaler work assumed 73.37 was the floor. For SAML Gateways it is not.

Three operational lies are in the ticket this morning.

1. “We patched NetScaler on 27–28 September, so this KEV is not us.” False if the running build is below 73.41 / 64.28 / 37.282 and a SAML action or IdP profile is in the config. Citrix wrote the second-upgrade sentence so operators would not make that mistake.
2. “CISA put a DoS on KEV, so we can wait.” The catalog row is still a three-day federal clock with forensic-triage language. The observed use, per Citrix, is targeted. The observed use, per Beazley, includes reboot-to-retry 88771 injection. A SAML Gateway that falls over is an identity outage. A SAML Gateway that reboots into an unpatched 88771 path is last week’s RCE again. Neither is a “later” ticket.
3. “Global Deny List means we can skip the ISO.” GDL is scoped to boxes already on the 88771 floor and not yet on the 88779 floor, and it needs Console plus signature v24. It does not hunt WHIPSHOT. It does not replace CTX694799 if the box was internet-facing in September.

A NetScaler in front of an industrial site is still an IT identity/edge compromise on this record. No source in this assessment claims process impact from 88779.

Who / what is affected

This CVE is not 88773–88778. Those remain on CTX697096. They are not on KEV in freeze 2026.10.04.

Technical context

RWP is not reproducing SAML payloads, username-field command strings, or crash primitives. Citrix’s published defender cut is enough: a memory-buffer overflow on the SAML SP/IdP path, reachable without authentication, that takes the service down. Availability only on the CNA vector.

What to inventory and hunt, from vendor and IR writing — configs, builds, and crash evidence, not an exploit path:

• Running build (show ns version) against CTX697174, not against last week’s 73.37 spreadsheet.
• Config strings add authentication samlAction and add authentication samlIdPProfile. Presence is exposure on an affected build, not proof of compromise.
• Unexpected NSPPE / authentication-daemon crashes and appliance reboots from 2 October onward on boxes that were already on 73.37 / 64.23.
• Whether Global Deny List is actually loaded (show appfw signatures, Encrypted Version ≥ v24) and whether stat denylist global AAA_REQUEST shows hits. Hits are mitigation telemetry, not a clean bill.
• Last week’s [WHIPSHOT / SLAPSHOT hunt](/posts/2026-09-30-netscaler-whipshot-slapshot/) if the box was below 73.37 / 64.23 at any point in September. 88779 does not retire that kit.
• Citrix IoC scan in NetScaler Console remains the vendor first-pass for 88771/88772. Citrix’s caveat from that campaign still applies: a clean scan is not proof.

ATT&CK mapping for the ticket, not a kill chain we ran:

No public proof-of-concept for 88779 is used in this assessment. We will not publish one.

Threat / exploitation status

Confidence on the KEV row, the due date, the SAML precondition, the new build floors, and Citrix’s DoS classification: high. Confidence that 88779 itself yields code execution: low on the current vendor and Beazley record. Confidence on actor, victim count, and how many 73.37 SAML Gateways were crashed: low. Confidence that every NetScaler is in: low — SAML config is the precondition Citrix described.

What defenders should do

1. Inventory every customer-managed ADC and Gateway — HA peer, SDX instance, DR, lab, FIPS, NDcPP. Record show ns version against CTX697174. Then grep the saved config for samlAction and samlIdPProfile. In scope = SAML configured and build below 14.1-73.41 / 13.1-64.28 / 14.1-73.41 FIPS / 13.1-37.282.
2. If in scope: snapshot, then upgrade. Citrix Console can list CVE-2026-88779 impacted instances and drive the upgrade job. The close is 14.1-73.41, 13.1-64.28, or the matching FIPS/NDcPP build — not 73.37. If you cannot take the window today, load Global Deny List signatures only as a bridge, and only if you are already inside the 73.37–73.41 (or 64.23–64.28) band with Console virtual patching on. Document residual.
3. Hunt the crash window before you declare the box clean. Unexpected reboots from 2 October on a 73.37 SAML Gateway are 88779-shaped. They are also a reason to re-run last week’s 88771/88772 IoC pass if that box was ever below the RCE floor in September. Preserve newnslog, authentication logs, and a config copy off-box. BOD 26-04 still wants forensic triage; an ISO can destroy the evidence.
4. Do not treat a deny-list hit counter as containment of WHIPSHOT. If September exposure is unknown, follow CTX694799 and the [30 September hunt](/posts/2026-09-30-netscaler-whipshot-slapshot/). PHP in unexpected web roots, SUID /bin/sh, HA-sync of attacker files — those survive a SAML DoS patch.
5. If the box is still below 73.37 / 64.23: that is two KEVs, not one. 88771 remains unauthenticated command execution on default config. Pull it off the internet or get to 73.41 (which includes both floors) before you argue about SAML.
6. Keep the rest of this window on the board. Zammad CVE-2026-102489 / CVE-2026-102490 are KEV, due today, 5 October. FortiMail CVE-2026-104286 was due yesterday, 4 October; FG-IR-26-175 was still marking builds upcoming on yesterday’s retrieval. Cisco SD-WAN Manager CVE-2026-76504 was due 3 October. The SAML Gateway is today’s interrupt; those clocks did not pause.

RWP assessment

Score 9.1.

Highest-leverage development since yesterday’s FortiMail due-date piece is a new KEV row on the same perimeter product we already had in the queue — except the floor moved. Catalog freeze 2026.10.04 / 1734, vendor-confirmed targeted DoS, SAML SP/IdP precondition, shipped builds, forensic triage Yes, due 7 October. The operator failure mode is treating 73.37 as done. Evidence quality is high on the catalog, CTX697174, and Citrix’s 3 October blog (CISA JSON, vendor bulletin, vendor CTI post). Evidence quality is intentionally split on whether 88779 is anything other than DoS: Citrix and Beazley say availability; secondary honeypot notes are not a CNA rewrite.

It outranks a second day on FortiMail CVE-2026-104286 because yesterday already assessed the due date and the notes/IR split; this retrieval did not produce a new KEV row or a PSIRT flip for FortiMail. It outranks Zammad CVE-2026-102489 / 102490 because that chain was Daily Top on 3 October; today’s due date is a clock, not a new exploitation picture. It outranks Cisco CVE-2026-76504 because that API bypass was Daily Top on 1 October and its 3 October due date has passed. It outranks 88773–88778 because they are still not on KEV.

What we are not saying: that 88779 is confirmed RCE; that 73.37 is out of 88771; that Global Deny List remediates a compromised appliance; that a named APT owns this CVE; that ransomware is using it; that every NetScaler is in; that a Gateway in front of a plant is confirmed process impact; that Citrix-managed cloud is independently verified patched.

What we are watching

• Whether Citrix or CISA reclassify 88779 from DoS if a reproducible integrity impact appears.
• Whether 88773–88778 pick up exploitation and join KEV.
• Whether the 73.41 / 64.28 floors show up as actually installed across the estate, or stall behind HA/SDX change windows.
• Whether GDL signature v24 coverage is real on Console-connected boxes, or only on paper.
• Zammad CVE-2026-102489 / 102490 due today — [3 October ticket](/posts/2026-10-03-zammad-cve-2026-102489-102490-kev/), still open.
• FortiMail CVE-2026-104286 — whether FG-IR-26-175 drops upcoming.
• Whether a public PoC for 88779 appears. We will not publish one.

Sources

• CISA — Adds one known exploited vulnerability (4 October 2026)
• CISA — KEV JSON catalog 2026.10.04
• CISA — Known Exploited Vulnerabilities Catalog
• CISA — BOD 26-04
• CISA — Critical zero-day vulnerabilities exploited in Citrix NetScaler ADC, Gateway
• Citrix CTX697174 — CVE-2026-88779
• Citrix — Understanding and Addressing CVE-2026-88779
• Citrix CTX697096 — CVE-2026-88771 through CVE-2026-88778
• Citrix CTX694799 — steps if NetScaler ADC is suspected compromised
• NetScaler Console — remediate CVE-2026-88779
• CVE-2026-88779 · NVD
• Beazley Security — BSL-A1216
• SecurityWeek — Exploitation hits appliances patched days earlier
• BleepingComputer — Citrix patches NetScaler SAML zero-day
• The Hacker News — New NetScaler zero-day exploited in targeted attacks
• HKCERT — Citrix products denial of service
• [RWP — NetScaler 88771/88772 KEV Daily Top, 28 September 2026](/posts/2026-09-28-citrix-netscaler-cve-2026-88771-88772-kev/)
• [RWP — WHIPSHOT/SLAPSHOT Daily Top, 30 September 2026](/posts/2026-09-30-netscaler-whipshot-slapshot/)