New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline

Citrix has released security updates addressing a high-severity vulnerability, CVE-2026-88779, affecting NetScaler ADC and Citrix NetScaler Gateway. The flaw is a memory overflow vulnerability with a CVSS score of 8.7 out of 10. It has been actively exploited in targeted zero-day attacks. The vulnerability can disrupt SAML-based authentication deployments, potentially knocking them offline. Organizations using NetScaler ADC or Gateway with SAML configurations are at elevated risk. Citrix urges immediate patching to mitigate exploitation risk.