Patched NetScaler Last Week? Check the New SAML Advisory.

A completed patch ticket is not enough to answer this week's NetScaler question. On October 3, Citrix published a new bulletin for CVE-2026-88779. Administrators need to compare their running build and SAML configuration with that bulletin, even if they recently upgraded. The Canadian Centre for Cyber Security's October 5 alert says Citrix reports exploitation in the wild and urges users and administrators to apply necessary updates. Who needs to check The bulletin covers customer-managed ADC and Gateway configured as a SAML service provider or identity provider, including affected hybrid instances. Citrix lists these fixed builds: Product branch / Fixed build or later in that branch ADC / Gateway 14.1 / 14.1-73.41 ADC / Gateway 13.1 / 13.1-64.28 ADC 14.1-FIPS / 14.1-73.41 FIPS ADC 13.1-FIPS / 13.1-NDcPP / 13.1-37.282 Check for add authentication samlAction or add authentication samlIdPProfile. These are the bulletin's builds as read October 7; check it again before upgrading. What is reported, and what is not Citrix's explanation describes targeted attacks on unmitigated deployments that can repeatedly disrupt service. It says its analysis has not identified an impact on customer-data integrity. This is the vendor's assessment, not our independent verification of any customer's system. An unavailable login gateway is a meaningful operational problem. These sources do not establish that this vulnerability stole passwords or exposed every customer's data. Citrix also explicitly tells affected customers who upgraded for CVE-2026-88771 through CVE-2026-88778 to upgrade again to the releases for CVE-2026-88779. Check the build rather than relying on last week's ticket. A focused review for the administrator Identify the owner of each customer-managed appliance, including standby nodes and hybrid instances. Record the running build and compare the relevant SAML configuration with the bulletin. Follow the vendor's upgrade procedure and your backup and change process. Verify the running build and login behavior afterward. Review unusual service failures with the security team. Preserve relevant logs and use your incident-response process if activity warrants investigation. Citrix offers Global Deny List signatures as a temporary mitigation. Its explanation lists specific software, Console, configuration, and signature requirements; simply assuming a default feature is active does not establish coverage. It still recommends installing the fixed software. If you are a user of an affected work application, send the advisory to its administrator. A browser privacy setting cannot update the organization's gateway.