{"uuid": "e3a72685-5ccb-414e-bffb-e18aeaf1cb48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88779", "type": "seen", "source": "https://gist.github.com/alon710/2a1ac2074ae10a8c5c664c8d13c0f492", "content": "# CVE-2026-88779: CVE-2026-88779: Improper Restriction of Operations within the Bounds of a Memory Buffer in Citrix NetScaler SAML Authentication Daemon\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-10-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-88779\n\n## Summary\nCVE-2026-88779 is a critical vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway affecting systems configured as a SAML Service Provider (SP) or SAML Identity Provider (IdP). An unauthenticated remote attacker can exploit this vulnerability to trigger a buffer overflow in the authentication daemon, resulting in persistent denial of service and appliance crash loops.\n\n## TL;DR\nAn unauthenticated remote buffer overflow vulnerability in Citrix NetScaler's SAML parsing daemon (nsaaad) allows attackers to trigger a persistent, cluster-wide denial of service loop on affected ADC and Gateway appliances.\n\n## Exploit Status: ACTIVE\n\n## Technical Details\n\n- **CWE ID**: CWE-119\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 8.7 (High)\n- **EPSS Score**: 0.00276\n- **Impact**: Denial of Service / High Availability Failover Loop\n- **Exploit Status**: active\n- **KEV Status**: Listed\n\n## Affected Systems\n\n- Citrix NetScaler ADC\n- Citrix NetScaler Gateway\n- **NetScaler ADC**: < 14.1-73.41 (Fixed in: `14.1-73.41`)\n- **NetScaler Gateway**: < 14.1-73.41 (Fixed in: `14.1-73.41`)\n- **NetScaler ADC**: < 13.1-64.28 (Fixed in: `13.1-64.28`)\n- **NetScaler Gateway**: < 13.1-64.28 (Fixed in: `13.1-64.28`)\n\n## Mitigation\n\n- Apply security patches immediately to NetScaler appliances\n- Deploy temporary responder policies bound to AAA_REQUEST\n- Apply latest Application Firewall signature updates via NetScaler Console\n\n**Remediation Steps:**\n1. Verify if SAML is active using the command 'show authentication samlAction'\n2. If vulnerable, download firmware build 14.1-73.41 or 13.1-64.28\n3. Install the updated firmware according to Citrix deployment guidelines\n4. Verify that the nsaaad daemon is stable and no core dumps are generated\n\n## References\n\n- [Citrix Security Bulletin CTX697174](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174)\n- [Citrix Tech Zone Security Blog](https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/)\n- [CISA KEV Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88779)\n- [Thomas Poppelgaard NetScaler Checker](https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker)\n- [Orjan Johansen NetScaler Threat Hunt Helper](https://github.com/orjanj/netscaler_threat_hunt_helper)\n- [Technical Background Blog & Remediation Guide](https://www.poppelgaard.com/cve-2026-88771-through-cve-2026-88778-what-you-should-know-and-how-to-fix-your-netscaler-adc-netscaler-gateway)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-88779) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-05T10:00:30.000000Z"}