Citrix Issues Emergency Patch for Actively Exploited NetScaler SAML Zero‑Day

Citrix Systems announced today that it has released emergency security updates to address a newly disclosed zero‑day vulnerability in its NetScaler ADC and NetScaler Gateway appliances.

The flaw, catalogued as CVE‑2026‑88779, resides in the SAML authentication module and can be triggered by maliciously crafted requests, leading to denial‑of‑service conditions on affected devices. Security researchers have confirmed that threat actors are already exploiting the weakness in the wild, prompting the rapid response.

NetScaler appliances are widely deployed as load balancers, reverse proxies and secure gateways for corporate web applications, and many organizations rely on their SAML support for single‑sign‑on integration with identity providers. Because the vulnerability is present in customer‑managed installations, unpatched systems remain exposed to disruption and could potentially be leveraged as stepping stones for broader network intrusion.

Citrix’s emergency advisory recommends that administrators apply the newly issued firmware updates without delay. The vendor also advises temporary mitigation measures such as disabling SAML authentication on affected appliances or restricting access to the vulnerable endpoints until patches can be installed.

Industry analysts note that the rapid exploitation of a SAML‑related flaw underscores the growing attention attackers are giving to identity‑centric components. Organizations that have postponed routine patch cycles are being reminded of the operational risk posed by unaddressed vulnerabilities in critical infrastructure.

Looking ahead, Citrix has pledged to monitor the situation closely and to release additional guidance as more information becomes available. Security teams are urged to review logs for signs of abnormal SAML traffic and to coordinate with incident‑response groups to contain any ongoing attacks.