Fixed again since. CTX697191 (2026-10-08) fixed CVE-2026-107406 in 14.1-73.46 / 13.1-64.29. Upgrade to the current safe build, not only the first fixed build for CVE-2026-88779.
The short answer
- Affected
- NetScaler ADC and NetScaler Gateway builds below the first fixed build for their release, when the precondition below is met.
- Fixed in
- 14.1-73.41 / 13.1-64.28First fixed builds for 14.1 / 13.1. All releases in the table below.
- Current safe build
- 14.1-73.46 / 13.1-64.29Includes later fixes. Advisory data as of 2026-10-15.
- CISA KEV
- Added 2026-10-04, federal due date 2026-10-07. Known ransomware use: Unknown.
- Forensic triage
- No forensic triage flag on this KEV entry.
- CVSS
- 8.7 (CVSS v4.0, vendor score in CTX697174)
- Preconditions
- Configured as SAML SP or SAML IdP
- Session kill advised
- No. The bulletin does not call for session termination.
Fixed builds from the Citrix® security bulletin CTX697174
| Release | First fixed build | Current safe build |
|---|---|---|
| NetScaler 14.1 | 14.1-73.41 | 14.1-73.46 |
| NetScaler 14.1 FIPS | 14.1-73.41 FIPS | 14.1-73.46 FIPS |
| NetScaler 13.1Past end of maintenance | 13.1-64.28 | 13.1-64.29 |
| NetScaler 13.1 FIPS/NDcPPPast end of maintenance | 13.1-37.282 FIPS | 13.1-37.283 FIPS |
FIPS and NDcPP builds have separate fixed builds: see the table and the bulletin.
What it is
“Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability”
Our advisory data, taken from CTX697174, summarises it as: SAML memory overflow (vendor: DoS; RCE suspected). Vulnerability class: memory overflow (CWE-119). Precondition: Configured as SAML SP or SAML IdP.
For the full description, read the CVE.org record for CVE-2026-88779 and the vendor bulletin.
Am I affected?
Two things must both be true: the appliance runs a build below the fixed build for its release (see the table above), and its configuration meets the precondition: Configured as SAML SP or SAML IdP. Find the build with show ns version on the CLI.
Enter your build to check it against CVE-2026-88779 and every other NetScaler CVE in our data. The checker runs in your browser and never connects to any appliance.
Open the checker with CVE-2026-88779 highlightedHow to patch
- Choose the target build: at least
14.1-73.41on 14.1 or13.1-64.28on 13.1. Prefer the current safe build (14.1-73.46 / 13.1-64.29), which also includes later fixes. FIPS and NDcPP appliances need their own fixed build from the table above. - Upgrade every node. In an HA pair, upgrade the secondary first, fail over, then upgrade the former primary. Our HA pair upgrade runbook walks through each step and the rollback.
- Confirm the build on each node with
show ns version, then work through the post-patch steps below.
13.1 is past end of maintenance, so plan the move to 14.1 while you are in the change window. Check the release dates in our NetScaler end-of-life guide.
If you cannot upgrade yet
- Global Deny List on 14.1-73.37 <= build < 14.1-73.41 and 13.1-64.23 <= build < 13.1-64.28; check with 'stat denylist global AAA_REQUEST'
Interim measures reduce exposure; only the fixed build removes the vulnerability.
After patching
Steps in the vendor bulletin
vendor bulletinThe bulletin does not call for session termination. It lists no post-patch steps beyond the upgrade.
Hunt for compromise
Upgrading does not remove an existing compromise. These indicators and tools are published guidance; we do not run them for you.
SAML overflow exploitation
- nsaaad crash loops on 73.37 / 64.23 boxes
- Payload fetches from 213.209.159[.]55 into /v (Beaumont)
Source: Kevin Beaumont; Help Net Security
Timeline
Related CVEs
- CVE-2026-107406Memory overflow leading to RCE or DoSNot in KEVLater fix (CTX697191)
- CVE-2026-88771(PitScaler)Unauthenticated command injection (default configuration)CISA KEVEarlier bulletin (CTX697096)
- CVE-2026-88772(PitScaler)DTLS memory overflow leading to RCECISA KEVEarlier bulletin (CTX697096)
Sources
- Vendor bulletin: CTX697174, NetScaler ADC and Gateway security bulletin for CVE-2026-88779 (published 2026-10-03)
- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-88779
- CISA KEV catalog JSON feed, version 2026.10.15: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Last verified 2026-10-15 against CISA KEV and CVE.org. Advisory data version 2026.10.15-1.