Dev.to Security 🔐 Cybersecurity Fri, 23 Oct 2026 10:32:29 +0000 👁 0 📖 1 min read

CVE-2026-88779: CVE-2026-88779: Improper Restriction of Operations within the Bounds of a Memory Buffer in Citrix NetScaler…

CVE-2026-88779: Improper Restriction of Operations within the Bounds of a Memory Buffer in Citrix NetScaler SAML Authentication Daemon Vulnerability ID: CVE-2026-88779 CVSS Score: 8.7 Published: 2026-10-04 CVE-2026-

CVE-2026-88779: Improper Restriction of Operations within the Bounds of a Memory Buffer in Citrix NetScaler SAML Authentication Daemon

Vulnerability ID: CVE-2026-88779
CVSS Score: 8.7
Published: 2026-10-04

CVE-2026-88779 is a critical vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway affecting systems configured as a SAML Service Provider (SP) or SAML Identity Provider (IdP). An unauthenticated remote attacker can exploit this vulnerability to trigger a buffer overflow in the authentication daemon, resulting in persistent denial of service and appliance crash loops.

TL;DR

An unauthenticated remote buffer overflow vulnerability in Citrix NetScaler's SAML parsing daemon (nsaaad) allows attackers to trigger a persistent, cluster-wide denial of service loop on affected ADC and Gateway appliances.

⚠️ Exploit Status: ACTIVE

Technical Details

CWE ID: CWE-119
Attack Vector: Network (AV:N)
CVSS Score: 8.7 (High)
EPSS Score: 0.00276
Impact: Denial of Service / High Availability Failover Loop
Exploit Status: active
KEV Status: Listed

Affected Systems

Citrix NetScaler ADC
Citrix NetScaler Gateway
NetScaler ADC: < 14.1-73.41 (Fixed in: 14.1-73.41)
NetScaler Gateway: < 14.1-73.41 (Fixed in: 14.1-73.41)
NetScaler ADC: < 13.1-64.28 (Fixed in: 13.1-64.28)
NetScaler Gateway: < 13.1-64.28 (Fixed in: 13.1-64.28)

Mitigation Strategies

Apply security patches immediately to NetScaler appliances
Deploy temporary responder policies bound to AAA_REQUEST
Apply latest Application Firewall signature updates via NetScaler Console

Remediation Steps:

Verify if SAML is active using the command 'show authentication samlAction'
If vulnerable, download firmware build 14.1-73.41 or 13.1-64.28
Install the updated firmware according to Citrix deployment guidelines
Verify that the nsaaad daemon is stable and no core dumps are generated

References

Read the full report for CVE-2026-88779 on our website for more details including interactive diagrams and full exploit analysis.

📰 Read the original article on Dev.to Security

Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.

← News 🔐 Cybersecurity 🏠 Home