NetScaler got another exploited hole a few days after the last one.

Citrix published CTX697174 for CVE-2026-88779 around October 3. CISA added it to KEV on October 4 with a federal due date of October 7. The bug is a memory overflow that can take the appliance into denial of service. Citrix says they have not seen integrity impact on customer data from this specific CVE. That does not make an offline gateway a small problem when people cannot get into email or the ERP.

What CVE-2026-88779 actually is

Scope is customer-managed NetScaler ADC and Gateway configured as a SAML service provider or identity provider. Cloud-managed Citrix services are on Citrix's patch train. Fixed builds include 14.1-73.41 and later, 13.1-64.28 and later on the 13.1 train, plus the matching FIPS / NDcPP builds called out in the bulletin. Important detail from Citrix: if you already jumped for CVE-2026-88771 through CVE-2026-88778, that jump does not close 88779. You may need to upgrade again. watchTowr said they could reproduce it after the rumours started. We are not going to reproduce it here.

This sits on top of a rough week for the product line. GTIG and others were already talking about malware on NetScaler from the earlier set. A DoS on the SSO front door is a different failure mode, but it is the same appliance class under sustained attention. If your change window was "we patched last Sunday," verify the build string, not the ticket title.

Why SSO shops feel this first

Plenty of Alberta MSPs and mid-market firms still put NetScaler in front of M365, on-prem Exchange, or a portal that staff treat as the whole company. When SAML SP or IdP is enabled, you are in the blast radius. An attacker who can keep the box in a crash loop does not need ransomware to ruin Monday. They only need your help desk flooded and your executives locked out of email.

Builds and checks

Confirm whether the appliance is SAML SP or IdP. If yes, move to a fixed build from CTX697174 before you argue about CVSS flavour. Capture the current build string and config snapshot first. After upgrade, watch for unusual crash loops, HA failovers, and SAML error spikes. If this box was also in scope for the late-September NetScaler KEVs, run Citrix's published integrity and IOC checks for those CVEs as well. Availability bugs and RCE bugs can share a calendar even when they do not share a root cause.

Bottom line

NetScaler is in a patch-twice month. CVE-2026-88779 is the SAML-facing DoS with a KEV stamp. Get the build that actually lists 88779, then prove SSO still works for the apps you care about. An offline gateway is a business outage with a CVE number.