CVE-2026-88779: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

According to SOCRadar, Citrix published the CVE and fixed builds on October 3[3]. Sophos also reports that the bug is a high-severity flaw (CVSS score of 8.7)[4] that affects NetScaler ADC and Gateway setups configured as a SAML Service Provider or Identity Provider.SOC Prime reports that Citrix calls it a memory overflow that can be "remotely triggered to cause denial of service without authentication or user interaction."[5] SOC Prime also says Citrix confirmed that it observed targeted attacks against unmitigated installations.[5]SOCRadar reports that CISA set an October 7 remediation deadline for covered federal agencies.[3] It adds that administrators began reporting crashes and repeated reboots on fully patched NetScaler appliances[3] before the fix came out.Aviatrix's threat research site claims researchers confirmed it enables remote code execution[6]. It says reports of web shell scripts did not establish that those payloads actually executed through this flaw.[5]According to watchTowr, Citrix says its analysis found no impact on the integrity of customer data.[7]Cloud Software Group strongly urges affected customers[8] to upgrade to builds 14.1-73.41, 13.1-64.28 or later. Techzine reports that anyone who has recently applied patches for CVE-2026-88771 through CVE-2026-88778 and meets the SAML requirements must update again.[9]