CVE-2026-88779 - NetScaler SAML DoS, followed by a SAML RCE

Anyone who patched the zero-days promptly got to do it twice more. On 2 October, Citrix flagged a “newly observed issue” in deployments using SAML with Gateway or AAA, and told admins to grep their configs for add authentication samlAction or samlIdPProfile. That became CVE-2026-88779 in bulletin CTX697174, an 8.7 denial of service fixed in 14.1-73.41, which CISA put in KEV on 4 October with a 7 October deadline. Then on Thursday 8 October came bulletin CTX697191 and CVE-2026-107406, a critical memory overflow reaching code execution on appliances configured for SAML. Its affected range is every build before 14.1-73.46 and 13.1-64.29: older builds as a SAML SP or IdP, and the builds that fixed the previous two rounds (14.1-73.37 through 73.41, 13.1-64.23 through 64.28) when configured as an IdP. That is three fixed builds in eleven days, and patching promptly bought SAML IdP operators exactly one more upgrade. Citrix makes no exploitation claim for this one and it isn’t in KEV, which after the month NetScaler has had counts as good news.