This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Citrix fixes an actively exploited vulnerability

Citrix fixes an actively exploited high-severity vulnerability [1] in NetScaler ACD and NetScaler Gateway [2]. Products and their fixed versions [2]: Citrix NetScaler ADC - 13.1-37.282 FIPS, 13.1-37.282 NDcPP, 13.1-64.28, 14.1-73.41, 14.1-73.41 FIPS Citrix NetScaler Gateway - 13.1-64.28, 14.1-73.41

Citrix NetScaler ADC, Citrix NetScaler Gateway - DoS (CVE-2026-88779)
CVSS 8.7 (High)

An unauthenticated remote attacker can, due to insufficient validation of the size of incoming data, use a specially crafted request to cause a memory overflow and thereby perform a DoS attack, provided that a SAML SP or SAML IdP configuration is in use (this can be verified by the presence of the 'add authentication samlAction' or 'add authentication samlIdPProfile' entries in the configuration) [2].

The vulnerability is present in products:

  • Citrix NetScaler ADC; >=13.1 FIPS, <13.1-37.282 FIPS; >=13.1 NDcPP, <13.1-37.282 NDcPP; >=13.1, <13.1-64.28; >=14.1, <14.1-73.41; >=14.1 FIPS, <14.1-73.41 FIPS;
  • Citrix NetScaler Gateway; >=13.1, <13.1-64.28; >=14.1, <14.1-73.41;

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

More information:

  • CVE-2026-88779 at cve.org, NVD
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer at cwe.mitre.org

The vulnerability was publicly disclosed 4. 10. 2026.

By CESNET, z.s.p.o. Táňa Macháčková on 5. 10. 2026.

CESNET, z.s.p.o. Logo