CVE-2026-88779: 
Citrix ADC VPX Análisis y mitigación de vulnerabilidades

CVE-2026-88779 is a memory buffer overflow vulnerability (CWE-119) in Citrix NetScaler ADC and NetScaler Gateway that allows unauthenticated remote attackers to cause a denial of service condition. The vulnerability was published on October 4, 2026, and affects NetScaler ADC versions before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; and NetScaler Gateway versions before 14.1-73.41 and before 13.1-64.28. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, CISA KEV). The vulnerability is specifically triggered through SAML processing components in affected appliances (Citrix Advisory).

The vulnerability is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), meaning the affected NetScaler code performs memory operations that read or write outside the intended buffer boundary during SAML request processing. Exploitation is network-based, requires no authentication, no user interaction, and no special privileges — making it fully automatable and trivially weaponizable against internet-exposed appliances. The flaw specifically manifests in SAML-configured deployments of NetScaler ADC and Gateway, where crafted network requests can trigger the memory overflow condition and crash the service (GitHub Advisory, CISA KEV). CAPEC patterns associated with this vulnerability include buffer overflow via parameter expansion (CAPEC-47), overflow buffers (CAPEC-100), and buffer manipulation (CAPEC-123).

Successful exploitation causes a denial of service, crashing or disabling NetScaler ADC or NetScaler Gateway services and rendering authentication infrastructure unavailable (CISA KEV). For organizations relying on NetScaler Gateway as their primary remote access or VPN gateway, exploitation can completely block user authentication and access to enterprise resources. SAML-based single sign-on deployments are particularly at risk, as crashing the SAML processing component can knock out federated authentication for entire organizations. There is no confirmed confidentiality or integrity impact from this specific vulnerability, but service disruption can facilitate broader attack chains by disabling security controls or forcing failover to less secure configurations (GitHub Advisory).

CVE-2026-88779 is actively exploited in the wild and was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on October 4, 2026, with a remediation due date of October 7, 2026 for federal agencies (CISA KEV). Exploitation has been reported even against appliances patched just days earlier, suggesting a narrow window between patch availability and active attack (BleepingComputer). The EPSS score is approximately 0.59% (47th percentile), though real-world exploitation activity significantly exceeds this model estimate. No confirmed public proof-of-concept exploit code has been identified, but the vulnerability is described as automatable by NVD SSVC assessment. This is the third actively exploited NetScaler zero-day disclosed within a single week, indicating a sustained and targeted campaign against Citrix infrastructure (CyberScoop).

1. Reconnaissance: Identify internet-facing NetScaler ADC or Gateway appliances using tools like Shodan or Censys, filtering for Citrix NetScaler banners and targeting versions prior to 14.1-73.41 or 13.1-64.28.
2. Identify SAML configuration: Confirm the target appliance is configured with SAML authentication (e.g., by probing SAML-related endpoints or reviewing publicly accessible login pages that indicate SAML IdP/SP configuration).
3. Craft malicious SAML request: Construct a specially crafted network request targeting the SAML processing component of the NetScaler appliance, designed to trigger an out-of-bounds memory operation in the vulnerable buffer handling code.
4. Send exploit payload: Transmit the crafted request to the target appliance over the network without any authentication credentials. No user interaction is required on the target side.
5. Trigger denial of service: The memory overflow condition causes the NetScaler SAML processing service to crash, rendering authentication services unavailable and potentially taking the entire gateway offline (CISA KEV, BleepingComputer).

• Network: Unusual or malformed HTTP/HTTPS requests to SAML-related endpoints on NetScaler appliances (e.g., /saml/login, /cgi/samlauth); high-volume requests from single or rotating source IPs targeting authentication endpoints.
• Logs: NetScaler system logs showing unexpected process crashes or restarts of the SAML authentication daemon; error messages referencing memory access violations or segmentation faults in /var/nslog/ or equivalent log paths.
• Availability: Sudden and repeated unavailability of SAML-based authentication services; users unable to authenticate via SSO while other services remain operational.
• Process: Unexpected restarts of NetScaler authentication processes; core dump files generated in NetScaler system directories following service crashes.
• Threat Intelligence: Inbound connections from IPs associated with known scanning or exploitation infrastructure targeting Citrix NetScaler appliances (CISA KEV, Abstract Security).

Citrix has released patched versions addressing CVE-2026-88779: NetScaler ADC and Gateway 14.1-73.41 or later, NetScaler ADC and Gateway 13.1-64.28 or later, NetScaler ADC 13.1-37.282 or later (FIPS/NDcPP), and NetScaler ADC 14.1-73.41 FIPS or later (Citrix Advisory). CISA mandated that U.S. federal agencies apply mitigations by October 7, 2026, per BOD 26-04 (CISA KEV). As an interim measure where immediate patching is not possible, administrators should consider restricting network access to SAML endpoints, implementing network segmentation to limit exposure of NetScaler management and authentication interfaces to untrusted networks, and monitoring for exploitation indicators. Upgrading to a patched version remains the only definitive remediation.

The vulnerability generated significant attention as the third actively exploited NetScaler zero-day disclosed within less than a week, prompting widespread alarm in the security community (CyberScoop, The Register). Security researcher Kevin Beaumont (GossiTheDog) commented on the situation via Mastodon, and BleepingComputer's coverage was widely shared across LinkedIn, Bluesky, and Reddit security communities. Sophos published a dedicated blog post on active exploitation (Sophos), and Tenable released an FAQ addressing the cluster of NetScaler zero-days (Tenable). Government agencies including Canada's CCCS, Australia, the UK NHS, and Hong Kong's GovCERT all issued advisories, reflecting the broad international concern over the vulnerability's impact on critical authentication infrastructure.