New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline

A critical memory overflow vulnerability (CVE-2026-88779) in Citrix NetScaler ADC and Gateway is being actively exploited in targeted attacks before a patch was widely applied, making this a classic zero-day risk scenario. The flaw specifically disrupts SAML-based authentication, meaning organizations relying on NetScaler for federated identity and single sign-on could face complete authentication outages. CISA's addition to the Known Exploited Vulnerabilities catalog underscores that threat actors are actively weaponizing this flaw against real targets, not just proof-of-concept environments. This incident highlights the danger of internet-facing network appliances that are slow to patch and the cascading impact a single infrastructure component failure can have on authentication pipelines across an organization.