NetScaler vulnerability exploited: check SAML configuration
HKCERT states that CVE-2026-88779 has been exploited in the wild and can cause denial of service. The advisory specifies that a device must be configured as a SAML SP or IdP to be affected by this vulnerability.
Basis: the official source labels this high risk. GDMME follow-up priority uses official ratings and headline/summary rules. It is not a CVSS score or official vulnerability rating, and does not confirm that your business is affected.
Source severity
高度風險（HKCERT）
Affected scope
NetScaler ADC/Gateway 14.1 earlier than 14.1-73.41 and 13.1 earlier than 13.1-64.28; FIPS/NDcPP branches are also involved. See the advisory for the full version list.
Official recommendations
Automatically extracted recommendation passages from the official source, retained in the source language. Check the complete advisory.
- Before installation of the software, please visit the vendor web-site for more details.
- Apply fixes issued by the vendor:
- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174
The last successful extraction is used here. Check the official source for the latest content.
Source text collected (Hong Kong time)：2026/10/14 05:05 HKT
官方原文建議自動摘錄 未作逐篇人工分析或翻譯；請核對完整公告、現行版本及適用性
GDMME recommended actions
GDMME recommendations · automatically organised from explicit products and source signals, without individual human analysis. Confirm applicability against vendor guidance and your environment.
- Locate Citrix NetScaler deployments, running versions and service owners in your inventory or management console; compare them with the vendor applicability criteria. A named product does not mean every deployment is affected.
- Check internet-reachable management interfaces, VPN access and administrator accounts on Citrix NetScaler. Restrict unnecessary exposure using vendor guidance after confirming administration and remote-work needs.
- Once Citrix NetScaler applicability is confirmed, check the official excerpt and complete vendor patch/mitigation instructions. Record before/after versions, test results and rollback steps; do not install updates solely from a news headline.
- Review administrator sign-ins, configuration changes and VPN sessions on Citrix NetScaler against authorised changes. Preserve logs and use the incident procedure for unfamiliar admin accounts or unauthorised changes.
Automatically organised (Hong Kong time)：2026/10/14 10:05 HKT
Educational information only. Confirm affected versions, mitigations and exploitation status with the original vendor advisory. Reports do not imply that GDMME equipment blocks every vulnerability.