Citrix NetScaler: after September's zero-days, CVE-2026-88779 and 107406 hit SAML

What happened

Anyone who patched NetScaler in late September was not done. In October Citrix published two more critical SAML-related flaws:

• CVE-2026-88779 (around October 3, CVSS 8.7): on appliances as a SAML SP or IdP it can cause DoS alone. CISA added it to KEV on October 4. On appliances still unpatched for September's flaws, attackers may also use it to force a reboot and accelerate code injected via CVE-2026-88771.
• CVE-2026-107406 (CVSS 9.5): a memory overflow in the builds that had just fixed CVE-2026-88771–88778. On SAML appliances it can lead to RCE or DoS. The bulletin lists no workaround.

Required builds

• CVE-2026-88779: 14.1-73.41+ or 13.1-64.28+
• CVE-2026-107406: 14.1-73.46+ or 13.1-64.29+

Stopping at 14.1-73.37 / 13.1-64.23 means another upgrade.

Why it matters

This is the fourth SAML issue in NetScaler since March. Patching once is not enough.

What to do now

1. Confirm your build; if below 14.1-73.46 / 13.1-64.29, schedule another window.
2. List NetScalers acting as SAML IdP or SP.
3. Keep hunting for September compromise; October's patch does not clean the past.

Sources

• CISA — Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler (updated Oct 9)
• iTnews — NetScaler builds that fixed zero-days carry critical flaw, too
• GovInfoSecurity — Citrix Patches Yet Another Under-Fire Zero-Day in NetScaler