CISA Gives Federal Agencies Until October 7 to Patch Citrix NetScaler Zero-Day Already Being Exploited
Citrix disclosed CVE-2026-88779, a SAML-triggered memory overflow in NetScaler ADC and Gateway, on October 4. CISA added it to the KEV catalog the same day and gave federal agencies until October 7 to mitigate.
On October 4, Citrix disclosed CVE-2026-88779, a memory buffer vulnerability with a CVSS score of 8.7 affecting NetScaler ADC and Gateway when SAML authentication is configured. CISA added the zero-day to its Known Exploited Vulnerabilities catalog the same day, requiring federal agencies to apply mitigations by October 7.
The flaw is a memory overflow that can lead to Denial of Service in deployments running under specific SAML authentication conditions, and Citrix has observed targeted attacks against unmitigated deployments, per eSentire’s analysis of the advisory.
The affected products — NetScaler ADC and NetScaler Gateway — are the sort of edge appliances organizations place in front of applications and remote access, and the SAML condition puts the vulnerable code path in the federated login flow rather than in an obscure corner of the management interface. That makes the exploit a perimeter problem, not a back-office one, which is exactly why a federal deadline matters: a device handling SAML assertions for authenticated access is not something an agency can simply unplug while the patch is tested.
The speed of the CISA listing is notable in its own right. The vulnerability was disclosed and added to the KEV catalog on the same day, with the October 7 mitigation deadline already set — an unusually tight timeline that reflects the confidence that comes with confirmed exploit activity. For the agencies bound by the catalog, the message is unambiguous: the vulnerability is known, it is being used, and the mitigations need to be in place by October 7.
For everyone else running NetScaler ADC or Gateway with SAML configured, the federal deadline is a useful benchmark even if it does not carry the force of a binding directive. The combination of a memory overflow carrying a CVSS score of 8.7, a specific and identifiable trigger condition, and confirmed targeted attacks in unmitigated deployments is exactly the setup where the gap between disclosure and exploitation tends to be at its shortest. The fix, whatever form it takes for a given deployment, should be treated with the same urgency CISA just assigned to it.