Citrix NetScaler ADC / Gateway October 2026 SAML flaws CVE-2026-88779, CVE-2026-88771, CVE-2026-88772, CVE-2026-107406: which build do I need?

Am I affected: customer-managed NetScaler ADC and NetScaler Gateway on 14.1 or 13.1 (including FIPS/NDcPP builds). Citrix-managed cloud services are handled by Citrix. In early October 2026 three issues were exploited as zero-days: CVE-2026-88771 and CVE-2026-88772 (fixed in 14.1-73.37 / 13.1-64.23), and CVE-2026-88779, a SAML-parsing memory overflow (CVSS 8.7, CISA KEV) that only matters when SAML authentication is used with Gateway or AAA. On October 8, Citrix also fixed CVE-2026-107406, a critical memory overflow (CVSS 9.5, possible remote code execution) that affects appliances configured as a SAML IdP or SP. Citrix reported no exploitation of it when the bulletin was published. How to check: run 'show ns version' on each appliance and check whether SAML IdP/SP or SAML-based Gateway/AAA authentication is configured. Fix: go straight to builds that cover all four issues: - NetScaler ADC/Gateway 14.1: 14.1-73.46 or later - NetScaler ADC/Gateway 13.1: 13.1-64.29 or later - 14.1-FIPS: 14.1-73.46 FIPS or later - 13.1-FIPS / 13.1-NDcPP: 13.1-37.283 or later Older release lines (13.0, 12.1) are end of life. Move them to a supported line. Interim mitigation (CVE-2026-88779 only): on 14.1-73.37 to 73.40 or 13.1-64.23 to 64.27, Citrix's Global Deny List signatures give temporary protection. Confirm they are active with 'show appfw signatures'. This does not cover CVE-2026-107406, so upgrade anyway. After patching: patching does not remove an existing compromise. Researchers reported web shells and wiped local logs on exploited devices. Hunt for unknown files and processes, use CISA's published detection rules, and, if you find signs of compromise, rebuild from a clean image and rotate credentials and session secrets that passed through the appliance. Sources: https://www.csoonline.com/article/4230642/citrix-warns-of-actively-exploited-netscaler-flaw-days-after-zero-day-patch-rush.html https://www.cybersecuritydive.com/news/citrix-patch-third-exploited-flaw-netscaler/832128/ https://bleepingcomputer.com/news/security/citrix-warns-admins-to-patch-new-netscaler-rce-flaw-immediately https://bleepingcomputer.com/news/security/citrix-patches-netscaler-saml-zero-day-exploited-in-attacks