CVE-2026-88779: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.
Overview
NetScaler ADC and NetScaler Gateway contain a memory buffer overflow in their SAML processing code. A remote, unauthenticated attacker can send a crafted SAML message to an affected appliance configured as a SAML service provider or identity provider, crashing the service and causing a denial of service. Citrix has confirmed targeted attacks against unmitigated deployments. Affected versions span the 13.1 and 14.1 release lines, including FIPS and NDcPP builds.
Vulnerability details
CWE-119 describes a condition where software reads or writes memory outside the boundaries of an allocated buffer. In NetScaler ADC and Gateway, the flaw resides in the code path that parses inbound SAML messages. When the appliance is configured as a SAML service provider or identity provider, it accepts SAML requests and responses from external parties before any authentication check occurs. A malformed message can cause the parser to operate outside its allocated buffer, corrupting memory state and crashing the affected service. Repeated triggering keeps the service unavailable.
An attacker with network access to the SAML endpoint sends a crafted SAML request or response. No credentials and no user interaction are required. The precondition is that the target appliance must be configured with either an authentication SAML action (SAML SP) or a SAML IdP profile. When that condition is met, the overflow is reachable from the network. The result is denial of service: the NetScaler ADC or Gateway service becomes unavailable. Citrix states no impact on data confidentiality or integrity, and has confirmed targeted attacks against unmitigated deployments.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Check the running NetScaler configuration for the presence of 'add authentication samlAction' or 'add authentication samlIdPProfile' entries. Either entry confirms the appliance meets the precondition and is exposed to this flaw if unpatched.
- Monitor NetScaler system logs and ns.log for unexpected service crashes or restarts following inbound SAML traffic, particularly where the crash recurs shortly after the service recovers, which may indicate repeated exploitation attempts.
- Review NetScaler access logs for high-volume or malformed SAML POST requests to authentication virtual server endpoints from unexpected source addresses, especially where requests lack valid SAML assertion structure.
Remediation
Additional hardening
- Upgrade NetScaler ADC and Gateway 14.1 to build 14.1-73.41 or later, and 13.1 to build 13.1-64.28 or later. For FIPS and NDcPP builds, upgrade to 14.1-73.41 FIPS or 13.1-37.282 respectively. See References for the full vendor advisory.
- If immediate patching is not possible and SAML SP or IdP functionality is not required, remove the 'add authentication samlAction' and 'add authentication samlIdPProfile' configuration entries to eliminate the precondition.
- Restrict network access to SAML authentication endpoints at the perimeter, limiting inbound SAML traffic to known identity provider or service provider IP ranges rather than accepting it from arbitrary sources.
- Apply CISA forensic triage guidance to any appliance that was internet-exposed and unpatched, as Citrix has confirmed targeted attacks against unmitigated deployments.
Key dates
References
- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174
- https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-88779
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88779
Frequently asked questions
Does CVE-2026-88779 affect my FedRAMP authorization?
If Citrix NetScaler runs inside your authorization boundary, yes. CVE-2026-88779 appears in CISA's Known Exploited Vulnerabilities (KEV) catalog, carrying a remediation deadline of October 7, 2026. For a FedRAMP-authorized service, an unpatched KEV within the boundary is an assessor finding. You must either remediate the vulnerability or formally document a mitigation before your assessor and sponsoring agency raise it during review.
How does Knox help me handle CVE-2026-88779?
Knox does not patch your Citrix NetScaler deployment. Under the FedRAMP shared-responsibility model, that remediation is yours to execute. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, along with continuous compliance monitoring and audit-artifact coverage to document the fix for your next assessment. The work of applying the patch stays with your team; managing compliance posture while you do it does not have to.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on an ongoing basis. For a KEV like CVE-2026-88779, that means exposure surfaces during continuous monitoring rather than waiting until an assessor flags it at a scheduled review.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
What happens if CVE-2026-88779 isn't remediated by October 7, 2026?
An unremediated CVE-2026-88779 becomes a Plan of Action and Milestones (POA&M) item. A growing POA&M list is precisely what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing the item out and documenting the remediation is what keeps your authorization clean and the agency relationship intact.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
