CVE-2026-88779 NetScaler vulnerability: your SAML fix needs a fix

The NetScaler vulnerability that CISA added to the KEV catalog on October 4, CVE-2026-88779, is a SAML memory overflow that attackers used to crash Citrix NetScaler ADC and Gateway appliances. Some of those boxes had been patched for the September zero-days only days earlier. Now there is a twist. If you upgraded to the fix builds for 88779 (14.1-73.41 or 13.1-64.28) and the appliance acts as a SAML identity provider, you sit inside the affected range of CVE-2026-107406. That one is a CVSS 9.5 memory overflow that Citrix says can lead to remote code execution. Four NetScaler CVEs in two weeks means the fix build from one bulletin can be the affected build in the next, so this post puts all of them on one table.

What happened

The story starts earlier than most admins realized, which matters for how far back you hunt.

• September 3, 2026: earliest known exploitation of CVE-2026-88772, the DTLS memory overflow, per Mandiant.
• September 20, 2026: Rapid7 saw the first CVE-2026-88771 attempts, a command injection that works in the default configuration.
• September 27, 2026: Citrix published CTX697096 with eight CVEs and fix builds 14.1-73.37 and 13.1-64.23. CISA added 88771 and 88772 to KEV the same day.
• October 2, 2026: admins reported fully patched appliances rebooting, with shell commands hidden in the username field of authentication requests.
• October 3, 2026: Citrix published CTX697174 for CVE-2026-88779 with new fix builds.
• October 4, 2026: CISA added CVE-2026-88779 to KEV with an October 7 deadline, the sixth exploited NetScaler flaw in the catalog this year.
• October 9, 2026: CVE-2026-107406 was reported under bulletin CTX697191, with no evidence of exploitation at disclosure.

Which NetScaler build is safe now

Each column below is a separate Citrix bulletin, and each one supersedes the column to its left. The last column is the one to plan against.

Branch	Sept 27 fix (88771, 88772)	Oct 3 fix (88779)	Oct 9 fix (107406)
ADC and Gateway 14.1	14.1-73.37	14.1-73.41	14.1-73.46
ADC and Gateway 13.1	13.1-64.23	13.1-64.28	13.1-64.29
ADC 14.1-FIPS	14.1-73.37 FIPS	14.1-73.41 FIPS	14.1-73.46 FIPS
ADC 13.1-FIPS and NDcPP	13.1-37.279	13.1-37.282	13.1.37.283

The version trap sits in the middle column. CTX697191 lists builds 14.1-73.37 through 14.1-73.41 and 13.1-64.23 through 13.1-64.28 as affected by CVE-2026-107406 when the appliance is configured as a SAML IdP. Builds older than those are affected as either a SAML SP or IdP. To test whether you meet the SAML precondition, look in ns.conf for add authentication samlAction (service provider) or add authentication samlIdPProfile (identity provider). Secure Private Access hybrid deployments that use NetScaler instances are in scope too, and versions 12.1 and 13.0 are end of life with no fix at all.

How the attack works

On paper CVE-2026-88779 is only a denial of service. Citrix found no impact on data integrity, and watchTowr reproduced it as a crash bug. Yet a crash is worth more to an attacker here than it looks, because of how CVE-2026-88771 detonates.

watchTowr’s post-exploitation analysis explains it. A single request poisons an on-disk log, and a scheduled job (ns_monuploadd_err.pl) later executes only the last poisoned entry, at some point within 24 hours. Attackers therefore race each other and wait. Crash the process with 88772 or 88779 and the warm reload executes the poisoned entry immediately. Rapid7 notes that each 88779 attempt crashes the SAML service and the sixth crash reboots the appliance, which fits the reboots admins reported on October 2. Coalition, the cyber insurer, told CyberScoop that the attempts clearly contain shellcode. Remote code execution through 88779 alone is not confirmed, so we would not bet on it either way. Treat an unexplained reboot on a SAML-enabled box as a possible intrusion, not an outage.

What lands afterwards is loud. watchTowr captured a Sliver implant staged to /var/vpn/ns_helper, a trojanized Dropbear SSH server on tcp/37512, a Perl stager that writes a gw_health superuser into ns.conf, and a PHP webshell under /var/netscaler/logon/LogonPoint/ reached through URLs shaped like LogonUISimple.html.style.min.<hex>.css. Rapid7 saw /flash/nsconfig tarred to /var/netscaler/gui/vpn/c, which anyone can then download from /vpn/c without logging in.

How to detect NetScaler exploitation

The injection itself leaves a trace in the authentication log line, which is where we would start. The Rapid7 sample reads Authentication is rejected for ...;tar${IFS}czf$IFS/var/netscaler/gui/vpn/c..., and the October 2 reports describe the same username-field trick. This maps to ATT&CK T1190.

Data source: NetScaler syslog (ns.log authentication events) forwarded to your SIEM

title: Shell Metacharacters in NetScaler Rejected Authentication Username
id: 5b0f2c7e-8f43-4a7e-9d51-2c6e8a3b7f10
status: experimental
description: Detects command injection payloads in the username field of NetScaler authentication failures, as seen with CVE-2026-88771 and the CVE-2026-88779 attack traffic.
references:
    - https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/
    - https://watchtowr.com/intelligence/post-exploitation-analysis-artifacts-citrix-netscaler-cve-2026-88771/
author: MarkCyber Research
date: 2026-10-11
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2026-88771
logsource:
    product: citrix
    service: netscaler
detection:
    selection_event:
        - 'Authentication is rejected for'
    selection_payload:
        - '${IFS}'
        - '$IFS'
        - '$('
        - '`'
        - 'base64'
        - 'curl '
        - 'fetch '
        - '/var/tmp/'
    condition: selection_event and selection_payload
falsepositives:
    - Users typing odd characters into the username box; review the source IP and the full line
level: high

The webshell route and the config grab show up in the access logs of whatever sits in front of the Gateway, or in the appliance’s own web logs (T1505.003).

Data source: web server or reverse proxy logs for the Gateway hostname

title: NetScaler Gateway Webshell Route or Config Archive Request
id: 9e1d4a62-3c75-4b2f-a8e0-7d4c1f6b2e93
status: experimental
description: Detects requests to the CSS-shaped webshell route and the /vpn/c config archive observed in CVE-2026-88771 post-exploitation.
references:
    - https://watchtowr.com/intelligence/post-exploitation-analysis-artifacts-citrix-netscaler-cve-2026-88771/
author: MarkCyber Research
date: 2026-10-11
tags:
    - attack.persistence
    - attack.t1505.003
logsource:
    category: webserver
detection:
    selection_webshell:
        cs-uri-stem|contains: '/logon/LogonPoint/css/LogonUISimple.html.style.min.'
        cs-uri-stem|endswith: '.css'
    selection_archive:
        cs-uri-stem: '/vpn/c'
    condition: selection_webshell or selection_archive
falsepositives:
    - None expected for the archive path; confirm the CSS route against a clean appliance first
level: critical

On the box, preserve a support bundle first, then walk the artifacts. Each line maps to one of the behaviours above.

Data source: NetScaler shell (FreeBSD), read only

grep -n "superuser\|gw_health" /flash/nsconfig/ns.conf
ls -la /var/tmp/ /var/vpn/ns_helper /var/netscaler/gui/vpn/c 2>/dev/null
find /var/netscaler/logon/LogonPoint -name ".*" -type f
cat /root/.ssh/authorized_keys /nsconfig/ssh/authorized_keys /nsconfig/.ssh/authorized_keys 2>/dev/null
sockstat -4l | grep 37512

A word on tuning. The first rule depends on your log pipeline keeping the full username string, so test it with a harmless value before you trust a quiet result. It also only matches the encodings seen so far, and an attacker who swaps ${IFS} for another trick walks past it, so a quiet result is not a clean bill of health. Benign reboots do happen. What makes a reboot worth investigating is a crash on a SAML-enabled appliance followed by any of the file artifacts above. watchTowr publishes an IOC repository for the callback domains and hashes.

Mitigation

1. Preserve logs, support bundles and snapshots before you touch anything. Patching and rebooting destroy volatile evidence, as watchTowr warns.
2. Upgrade to 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS or 13.1.37.283 (FIPS and NDcPP), per Citrix bulletin CTX697191. Those builds carry every fix in the table above.
3. If you cannot upgrade today, Citrix’s Global Deny List signatures cover CVE-2026-88779 on non-FIPS 14.1 and 13.1 appliances already on the September 27 builds and managed through NetScaler Console. CTX697191 offers no workaround for 107406, only the upgrade.
4. Run the NetScaler Console indicator of compromise script. If you find a hit, rebuild the appliance rather than cleaning it, and rotate every secret stored under /flash/nsconfig, which, per Rapid7’s analysis, includes encrypted admin passwords, LDAP and RADIUS bind passwords, and TLS private keys.

Most edge devices cannot run EDR, as Mandiant pointed out, so your SOC sees them only through the logs you forward. If NetScaler syslog does not reach your SIEM today, that gap is worth closing first, and it is the kind of work our AI-driven SOC team does. We covered the same pattern on F5 BIG-IP APM on September 24.

Bottom line

If a NetScaler in your estate uses SAML, upgrade it to 14.1-73.46 or 13.1-64.29 now, even if you already patched for CVE-2026-88779. Then treat every unexplained reboot since September 3 as a lead, and hunt for the artifacts before you trust the box.