Citrix is urging customers to patch CVE-2026-88779, an exploited NetScaler memory overflow flaw that can interrupt service on appliances using SAML authentication. In guidance covered by October 4, 2026 reporting, the vendor confirmed targeted attacks against unmitigated deployments. Affected organizations must install newer builds even if they applied the previous round of emergency updates.

Tenable updated its NetScaler analysis on October 4 to distinguish this vulnerability from the flaws patched on September 27. Its review says organizations using SAML need another upgrade. The new issue affects customer-managed NetScaler ADC and NetScaler Gateway, products used to deliver applications and provide remote access; Citrix handles updates for its managed cloud services.

Citrix bulletin CTX697174 assigns the flaw a CVSS v4.0 score of 8.7 and describes its impact as denial of service. Exposure requires an appliance configured as a SAML service provider or identity provider. Administrators can identify those settings by checking for add authentication samlAction or add authentication samlIdPProfile entries in their NetScaler configuration.

In its accompanying technical guidance, Citrix says repeated triggering can leave services unavailable. The company says its analysis has not identified an impact on customer data integrity. Its published classification remains denial of service. The vendor has not named the attackers or provided a count of affected customers in that guidance.

The bulletin lists fixed standard builds as 14.1-73.41 and 13.1-64.28 or later releases in the respective branches. NetScaler ADC 14.1-FIPS requires 14.1-73.41 FIPS or later, while 13.1-FIPS and 13.1-NDcPP require 13.1-37.282 or later. Citrix also says Secure Private Access Hybrid customers using affected NetScaler instances must upgrade those instances.

Citrix has released Global Deny List signatures to help reduce exposure while customers prepare upgrades. Availability depends on supported software versions and NetScaler Console configuration, with prerequisites detailed in its guidance. The vendor continues to recommend installing fixed software promptly, reviewing configurations and following incident response procedures if signs of compromise appear.