FlawOpen

flawopen.com/Teardowns/cve-2026-88779-citrix-netscaler-saml-memory-overflow

● CVE-2026-88779 · CVSS v4 8.7 · High
FlawOpen Security Research

CVE-2026-88779: Citrix NetScaler SAML Memory Overflow

CVE-2026-88779 is a memory-overflow vulnerability in customer-managed Citrix NetScaler ADC and Gateway. It affects deployments with SAML authentication configured and is being used in targeted attacks to cause denial of service; Citrix reports no identified customer-data integrity impact.[1], [2], [3]

💡 Plain English Explainer (ELI5)

A lobby queue has a fixed number of spaces. If a clerk accepts a ticket claiming to need more space than the queue has, the desk can jam and stop serving anyone. This bug is a memory-boundary failure in a specific SAML deployment path; the confirmed impact is availability, not a documented RCE.[1]

Core Concepts & Subsystem Terms

SAML SP / IdP
Service provider and identity provider roles in SAML authentication; Citrix says either configuration is a precondition.[1]
CWE-119
Improper restriction of operations within the bounds of a memory buffer.[1]
Global Deny List
Citrix virtual-patching feature; only a temporary mitigation under documented prerequisites.[2]
Related CVE-2026-88771
A separate CWE-20 unauthenticated RCE affects all customer-managed deployments. It is not this SAML-dependent CWE-119 denial-of-service flaw; both appear in Citrix bulletin CTX697096 and share fixed release lines.[6]

Framework mappings

Root Cause Analysis

Citrix classifies CVE-2026-88779 as CWE-119, CVSS 4.0 8.7, and describes memory overflow leading to denial of service when NetScaler ADC or Gateway is configured as a SAML service provider (SP) or identity provider (IdP). Citrix’s companion guidance narrows assessment to SAML authentication used with Gateway or AAA functionality and reports targeted attacks on unmitigated deployments. Citrix says repeated triggering may keep the service unavailable and that it has not identified customer-data integrity impact. The vendor has not published affected source lines or a patch diff; the C example below is a generic bounds-check illustration, not NetScaler code or a vulnerability reproduction. Inspect the configuration for add authentication samlAction (SAML SP) or add authentication samlIdPProfile (SAML IdP), assess the Gateway/AAA context, apply the fixed build, and only use Global Deny List virtual patching where Citrix’s documented version and console prerequisites are met.[1], [2]

CVE-2026-88779 scope and remediation matrix

AreaDocumented condition or buildOperator action
Affected configurationCustomer-managed ADC/Gateway with SAML SP or IdP configured in the Gateway/AAA context.Inspect add authentication samlAction and add authentication samlIdPProfile; assess the Gateway/AAA context.
ADC/Gateway 14.1Affected before 14.1-73.41; fixed at 14.1-73.41 or later.Upgrade to the fixed build for this branch.
ADC/Gateway 13.1Affected before 13.1-64.28; fixed at 13.1-64.28 or later.Upgrade to the fixed build for this branch.
ADC 14.1-FIPSAffected before 14.1-73.41 FIPS; fixed at 14.1-73.41 FIPS or later.Upgrade to the FIPS fixed build; do not substitute the standard build number.
ADC 13.1-FIPS/NDcPPAffected before 13.1-37.282; fixed at 13.1-37.282 or later.Upgrade to the applicable FIPS/NDcPP fixed build.
Global Deny List eligible interim builds14.1-73.37 ≤ build < 14.1-73.41; 13.1-64.23 ≤ build < 13.1-64.28.Use only as temporary virtual patching after confirming all Citrix prerequisites; it does not replace upgrading.
Global Deny List prerequisitesNetScaler Console with Cloud Connect or Console service; virtual patching enabled; default signatures v24 or newer.Verify with show appfw signatures and stat denylist global AAA_REQUEST; check current Citrix guidance before enabling.

Step-by-Step Attack Flow

Step 1

SAML request reaches the configured service

A crafted network request reaches the SAML authentication path on a deployment meeting Citrix’s preconditions.[1], [3]

Step 2

Memory-boundary failure is triggered

The vulnerable memory-boundary handling can be triggered; Citrix documents denial of service as the impact and reports targeted exploitation.[1]

Step 3

The authentication service becomes unavailable

If repeatedly triggered, the affected service may remain unavailable. Citrix has not identified an integrity impact; do not inflate this CVE into RCE.[1], [2]

Step 4

Verify scope, mitigate, and patch

Inspect SAML configuration and Gateway/AAA context, use only eligible Global Deny List mitigation if needed, then upgrade to the fixed release.[1], [2]

Source Code: Flaw vs. Secure Implementation

This C example illustrates a general buffer-capacity check. Citrix has not published the vulnerable NetScaler source code or patch diff. The example is not a CVE reproduction; the supported product remediation is Citrix’s fixed build, with Global Deny List available only as a qualified interim mitigation.

Source excerpt: Generic C bounds-check example; not Citrix NetScaler source

UNPATCHED FLAW
#include <stddef.h>
#include <stdint.h>
#include <string.h>

int copy_field(uint8_t *dst, const uint8_t *src, size_t len) {
    /* Generic unsafe pattern: input length is not checked against dst. */
    memcpy(dst, src, len);
    return 1;
}
HARDENED SECURE PATCH
#include <stddef.h>
#include <stdint.h>
#include <string.h>

int copy_field(uint8_t *dst, size_t dst_capacity,
               const uint8_t *src, size_t len) {
    if (len > dst_capacity) return 0;
    memcpy(dst, src, len);
    return 1;
}

Engineering & System Hardening Checklist

Sources