Citrix Deploys Urgent Patch for Actively Exploited NetScaler SAML Zero‑Day

Citrix Systems disclosed today that it is issuing emergency security updates to remediate a freshly revealed zero‑day flaw affecting its NetScaler ADC and NetScaler Gateway devices.

Identified as CVE‑2026‑88779, the defect lives within the SAML authentication component and can be activated by specially crafted requests, causing denial‑of‑service outcomes on compromised units. Researchers have verified that attackers are already leveraging the vulnerability in real‑world scenarios, driving the swift remediation.

NetScaler devices are commonly used as load balancers, reverse proxies and secure gateways for enterprise web services, with numerous firms depending on their SAML capability for single‑sign‑on ties to identity providers. Since the flaw exists in customer‑controlled deployments, systems that stay unpatched stay vulnerable to outages and may be abused as footholds for wider network breaches.

Citrix’s urgent advisory urges administrators to install the freshly released firmware updates immediately. The company also suggests interim mitigations like turning off SAML authentication on the impacted devices or limiting access to the exposed endpoints until the patches are applied.

Analysts point out that the swift abuse of a SAML‑related defect highlights the increasing focus attackers place on identity‑centric elements. Firms that have delayed regular patching are being reminded of the operational danger presented by lingering vulnerabilities in essential infrastructure.

Going forward, Citrix commits to closely tracking the issue and issuing further guidance as new details emerge. Security personnel are advised to examine logs for anomalous SAML activity and to work with incident‑response teams to contain any active exploits.