New Citrix NetScaler SAML Flaw Triggers Crashes and Suspected Exploitation Attempts

Citrix NetScaler administrators report repeated crashes and forced reboots on patched internet-facing ADC/Gateway appliances (including 14.1-73.37) after emergency updates; the disruption is linked to a newly observed SAML-related issue where crafted authentication requests crash the nsaaad daemon. The report notes prior critical zero-days (CVE-2026-88771 and CVE-2026-88772) that have been exploited in the wild, describes observed payload-bearing or malformed SAML requests and service failures, and advises preserving logs, reviewing SAML configurations, verifying builds on HA nodes, enabling recommended settings, and following forthcoming vendor guidance.