CISA added CVE-2026-88779, a Citrix NetScaler vulnerability affecting SAML deployments, to its Known Exploited Vulnerabilities catalog on October 4 after evidence of active exploitation. The issue has been described as an improper restriction of operations within the bounds of a memory buffer.
The operational takeaway is immediate: organizations running customer-managed NetScaler appliances should identify SAML-enabled deployments, apply Citrix’s emergency updates, and review appliance and identity logs for anomalous activity. CISA’s KEV entry makes this a prioritized remediation item for federal civilian agencies; it is also a strong signal for other defenders to treat the exposure as urgent.
Attack reporting says the flaw can be used to cause denial of service on affected SAML deployments. Because public reporting has described active exploitation, defenders should not assume patching alone addresses prior compromise. Preserve relevant logs and investigate suspicious access around the exposure window.
Sources: CISA KEV alert; BleepingComputer reporting; SecurityWeek reporting.