Vulnerability Notification – Citrix NetScaler SAML Zero-Day Actively Exploited

(TLP:CLEAR) A high-severity memory overflow vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway is being actively exploited in the wild as a zero-day. Tracked as CVE-2026-88779 (CVSS v4.0 8.7), the vulnerability impacts appliances configured as a SAML Service Provider (SP) or SAML Identity Provider (IdP). Successful exploitation could allow a remote attacker to cause a denial of service, and Citrix notes that the service may remain unavailable if the condition is triggered repeatedly.