CVE-2026-88779: Citrix NetScaler Zero-Day Exploited Against SAML Deployments

The report covers CVE-2026-88779, a high-severity memory-overflow vulnerability in customer-managed Citrix NetScaler ADC and Gateway appliances configured as SAML SP or IdP that has been actively exploited in targeted attacks to cause denial-of-service. Citrix assigns a CVSS v4.0 score of 8.7, CISA added the flaw to its Known Exploited Vulnerabilities catalog, and vendor fixes are available (upgrade to specified NetScaler releases). Organizations are advised to prioritize patching, investigate unexplained reboots or signs of payload retrieval, review logs and outbound connections, rotate credentials if compromise cannot be ruled out, and deploy detection/hunting content where possible.