Citrix ships emergency fix for new NetScaler SAML flaw exploited in attacks
CVE-2026-88779 in NetScaler ADC and Gateway affects SAML setups; customers who patched for earlier flaws must update again.
During the first weekend of October 2026, Citrix released updates for CVE-2026-88779 in NetScaler ADC and Gateway appliances. The memory overflow flaw was exploited in targeted attacks that caused service outages on systems using SAML. CISA added it to its catalog of exploited vulnerabilities.
According to a BleepingComputer report dated 4 October 2026, Citrix released fixes on Sunday morning for CVE-2026-88779, a flaw affecting NetScaler ADC and NetScaler Gateway appliances. The memory overflow bug carries a CVSS score of 8.7 and is classified by Citrix as a denial-of-service issue. The company said it had seen targeted attacks against unpatched systems.
- Only appliances with SAML authentication configured together with Gateway or AAA functionality are affected.
- Fixed versions are 14.1-73.41 and 13.1-64.28; build 13.1-37.282 was released for 13.1 customers on FIPS and NDcPP.
- Researchers are looking into whether the flaw also allows remote code execution; one administrator saw download attempts using shell commands placed in the username field but could not confirm that they ran.
- CISA added the flaw to its exploited vulnerabilities catalog and gave US federal agencies until 7 October.
Why it matters
Citrix confirmed that this issue is different from the NetScaler flaws it disclosed earlier. Companies that recently updated for CVE-2026-88771 through CVE-2026-88778 must update again if they use SAML. For businesses in Türkiye that rely on NetScaler for remote access and application delivery, this could mean a second maintenance window in a short time.
Citrix also provides Global Deny Lists, which block access from known malicious IP addresses, but recommends installing the new security updates as soon as possible. Customers who run into this SAML issue are asked to contact Citrix support.
Sources
More articles
Microsoft to process Claude models in Copilot inside the EU Data Boundary by the end of 2026
Microsoft says Anthropic's Claude models in Copilot will move into the EU Data Boundary. The target is the end of 2026, and the Claude setting is off by default in the EU and EFTA.
November 5, 2026 · Source: MicrosoftGoogle makes Gemini Omni 1.2 Flash video model generally available with clips up to 15 seconds
Google made its video generation and editing model Gemini Omni 1.2 Flash generally available on 5 November 2026. It is rolling out to the Gemini API, Google Cloud, Flow, Google Vids, the Gemini app and Google Ads.
November 5, 2026 · Source: Google BlogShopify's third-quarter revenue rises 32 percent to 3.74 billion dollars
In third-quarter results published on 3 November 2026, Shopify reported revenue up 32 percent and gross merchandise volume (GMV) up 29 percent. The company expects revenue growth in the low thirties percent again in the fourth quarter.
November 3, 2026 · Source: Shopify (SEC 8-K)