Citrix NetScaler vulnerability CVE-2026-88779: exploited SAML flaw, builds to install and checks

The short answer: on 4 October 2026 Citrix released a fix for CVE-2026-88779, a flaw in NetScaler ADC and NetScaler Gateway configured for SAML that was already being exploited in targeted attacks. CISA added it to its catalogue of exploited vulnerabilities the same day. On 8 October, Citrix fixed a second flaw in the same area, CVE-2026-107406, rated critical and capable of leading to remote code execution. Any business that publishes remote access, an application portal or single sign-on through NetScaler should install at least 14.1-73.46 or 13.1-64.29, and preferably the builds released on 26 October.

In Morocco, NetScaler often acts as the remote access gateway to business applications and virtual desktops, particularly in multi-site organisations. Morocco’s maCERT (DGSSI) issued several NetScaler bulletins in October. This alert brings together what they say, along with the checks to carry out.

What is affected

Both flaws affect customer-managed NetScaler appliances configured for SAML:

• as a SAML service provider (SP): an add authentication samlAction command in the configuration;
• as a SAML identity provider (IdP): an add authentication samlIdPProfile command.

CVE-2026-88779 is a memory overflow (CWE-119). Citrix describes it as a denial of service: a remote, unauthenticated attacker can bring down authentication and therefore remote access. CVE-2026-107406 is also a memory overflow which, according to Citrix, can lead to remote code execution or denial of service.

One important point: for CVE-2026-107406, the builds that had just fixed CVE-2026-88779 (14.1-73.41 and 13.1-64.28) remain vulnerable when the appliance is configured as a SAML IdP. A business that rushed the update on 4 October therefore has to update a second time.

Product	Affected versions	Fixed version
NetScaler ADC and Gateway 14.1	before 14.1-73.41 (CVE-2026-88779); before 14.1-73.46 (CVE-2026-107406)	14.1-73.46; 14.1-73.49 with the PHP2Shell fix
NetScaler ADC and Gateway 13.1	before 13.1-64.28 (CVE-2026-88779); before 13.1-64.29 (CVE-2026-107406)	13.1-64.29; 13.1-64.32 with the PHP2Shell fix
NetScaler ADC 14.1-FIPS	before 14.1-73.41 FIPS; before 14.1-73.46 FIPS	14.1-73.46 FIPS; 14.1-73.49 FIPS with the PHP2Shell fix
NetScaler ADC 13.1-FIPS and 13.1-NDcPP	before 13.1-37.282; before 13.1-37.283	13.1-37.283; 13.1-37.286 with the PHP2Shell fix
Citrix-managed cloud services	not affected, updated by the vendor	no customer action

Sources: Citrix bulletins CTX697174 (4 October) and CTX697191 (8 October), NVD entries, maCERT bulletins 69160510/26, 69390910/26 and 67122810/26.

Severity and exploitation

• Published severity: Citrix gives CVE-2026-88779 a CVSS v4.0 score of 8.7 (high) and CVE-2026-107406 a CVSS v4.0 score of 9.5 (critical), as shown by the NVD. maCERT rates CVE-2026-88779 as critical for both risk and impact, and CVE-2026-107406 as important.
• Exploitation of CVE-2026-88779: Citrix observed targeted attacks that caused denial of service on unpatched appliances. CISA added it to its KEV catalogue on 4 October 2026, with a 7 October deadline for US federal agencies. Researchers quoted by BleepingComputer are investigating possible code execution; for now, Citrix maintains the denial-of-service classification.
• Exploitation of CVE-2026-107406: at the time of publication, Citrix said it was not aware of any exploitation. The flaw is not in the KEV catalogue as of this alert.
• Context: these flaws follow CVE-2026-88771 and CVE-2026-88772, two exploited NetScaler flaws added to the KEV catalogue on 27 September 2026. maCERT also issued bulletins on 23 and 28 October stating that the PHP “PHP2Shell” flaws affect NetScaler ADC and Gateway too, fixed in the 26 October builds (Citrix bulletin CTX697263).

Interim measures, if the update has to wait a few hours

Citrix offers no workaround equivalent to the fix. What you can do in the meantime:

1. Apply the Global Deny Lists that Citrix provides to block known malicious IP addresses, bearing in mind that the vendor still recommends updating.
2. Plan a short maintenance window: updating a NetScaler interrupts remote access. In a cluster or high-availability pair, update the secondary node, fail over, then update the primary.
3. Restrict access to the management interface to the management network only: maCERT also points to Citrix’s guidance on protecting management access in the context of PHP2Shell.

Checks to carry out

• Identify SAML appliances: search for samlAction and samlIdPProfile in the running configuration (show ns runningConfig). If you use NetScaler Console, the security advisory dashboard lists the instances affected by CVE-2026-88779.
• Check the build actually running on every node, including standby, pre-production and disaster recovery appliances, which are often forgotten.
• Confirm the second update: a 14.1-73.41 or 13.1-64.28 build installed in early October is no longer enough.
• Look for traces: unexplained restarts or crashes of the packet processing engine, unusual SAML authentication attempts in the logs, unknown files in the appliance’s web directories. CISA also asks federal agencies to carry out a forensic triage in addition to patching.
• Review authentication: if the appliance was exposed without the fix, renew active sessions and check the accounts and certificates tied to SAML.

Our view for businesses in Morocco

NetScaler is an access appliance: when it goes down, remote work, access to applications and sometimes sales activity stop with it. The riskiest case we see is the appliance installed by an integrator for a one-off project, then left without a clear owner. The second is the emergency update done once, with no follow-up on later bulletins: October 2026 shows that NetScaler had to be updated three times.

These alerts are a reminder of remote access fundamentals: a properly sized business VPN or ZTNA approach, multi-factor authentication on every access, and a Zero Trust approach. If your web servers run PHP, also read our alert on the PHP2Shell vulnerability. For the organisations concerned, Law 05-20 and DGSSI requirements make handling these bulletins mandatory, and managed EDR with 24/7 monitoring helps spot abnormal behaviour.

How we can help

We identify your exposed remote access appliances, check their SAML configuration and build, plan updates with a controlled failover and look for signs of compromise. We then provide 24/7 monitoring, with critical incidents handled in under 15 minutes. See our approach to business cybersecurity in Morocco, then request your free initial audit: we reply within 24 business hours.

Sources: Citrix bulletin CTX697174, Citrix bulletin CTX697191, CISA KEV catalogue, NVD CVE-2026-88779, NVD CVE-2026-107406, maCERT: CVE-2026-88779, maCERT: CVE-2026-107406, maCERT: PHP2Shell and NetScaler, Canadian Centre for Cyber Security advisory AV26-996, Sophos CTU, BleepingComputer.