Citrix NetScaler zero-day exploited to take SAML deployments offline

Citrix has fixed CVE-2026-88779, a memory overflow vulnerability in NetScaler ADC and NetScaler Gateway that has already been exploited in targeted attacks. The flaw, rated 8.7 out of 10, can cause repeated service crashes and make vulnerable appliances unavailable. Exposure requires specific SAML configurations, with the device used as a service provider or identity provider. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, highlighting a significant risk, particularly for federal infrastructure and remote access services. Organizations must immediately check device configurations and versions, apply Citrix updates, and review logs for disruptions or anomalous activity.

Source: Help Net Security