CISA lists NetScaler SAML flaw as exploited after another patch release

CISA added NetScaler vulnerability CVE-2026-88779 to its Known Exploited Vulnerabilities catalog on October 4, according to a security analysis published on note. The flaw affects customer-managed ADC and Gateway appliances configured to provide or consume SAML authentication, which lets services exchange login credentials. Citrix released fixes on October 3. Appliances updated for the September 27 vulnerabilities still require another update if they use the affected configuration. The required main-branch builds are 14.1-73.41 or later and 13.1-64.28 or later. Citrix identifies the impact as denial of service caused by memory overflow. watchTowr reproduced the flaw on October 5 and assessed it as denial of service; remote code execution through this vulnerability has not been confirmed.