CVE-2026-88779: Improper Restriction of Operations within the Bounds of a Memory Buffer in Citrix NetScaler SAML Authentication Daemon

Citrix NetScaler ADC and Citrix NetScaler Gateway are widely deployed application delivery controllers and remote access solutions.

A critical vulnerability, designated CVE-2026-88779, exists within the authentication daemon of these appliances when configured to handle Security Assertion Markup Language (SAML) assertions. Specifically, the vulnerability affects systems operating as a SAML Service Provider (SP) or SAML Identity Provider (IdP).

The underlying flaw is classified as an Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119). An unauthenticated remote attacker can exploit this vulnerability by transmitting a specially crafted SAML payload to the NetScaler authentication endpoint. The vulnerability does not require any administrative privileges or user interaction to execute.

Successful exploitation results in immediate termination of the authentication service, leading to cascading system failure. In high availability (HA) environments, this triggers automatic failover loops and results in persistent, cluster-wide denial of service.

The root cause of CVE-2026-88779 resides in the NetScaler Authentication, Authorization, and Auditing Daemon (nsaaad).

This daemon is responsible for managing authentication routines, session enforcement, and federation protocols like SAML. When SAML integration is enabled, nsaaad processes unauthenticated incoming XML payloads representing SAML AuthnRequests, Responses, or metadata elements.

The parsing architecture within nsaaad utilizes an internal parser to extract XML elements, attributes, and long base64-encoded strings. The parser fails to perform strict bounds verification before copying attribute strings into pre-allocated memory buffers. When processing extremely long XML tags or deeply nested structure patterns, the parser writes data beyond the allocated buffer boundary.

This buffer overflow causes memory corruption in adjacent data blocks on the heap or stack. When critical pointers or control structures are overwritten, the process encounters a memory protection violation. This triggers a segmentation fault (SIGSEGV), causing the nsaaad daemon to abort and crash.

Due to the closed-source nature of Citrix NetScaler firmware, the following code analysis is reconstructed from binary decompilation of the nsaaad daemon.

The analysis compares the vulnerable implementation of the SAML XML parsing logic with the corrected version introduced in firmware builds 14.1-73.41 and 13.1-64.28.

In the vulnerable implementation, the copy operation lacks a boundary constraint when reading specific SAML token elements:

// Decompiled conceptual representation of vulnerable parsing function
void parse_saml_element_value(const char *xml_source, char *destination_buffer) {
    int index = 0;
    // The loop copies characters until encountering an XML closing delimiter
    while (xml_source[index] != '<' && xml_source[index] != '\0') {
        // Missing boundary check: destination_buffer size is fixed
        destination_buffer[index] = xml_source[index];
        index++;
    }
    destination_buffer[index] = '\0';
}

The patched version introduces explicit length validation against the destination buffer's capacity. If the incoming element length exceeds the target capacity, the parser aborts the operation safely and logs a validation error:

// Decompiled conceptual representation of fixed parsing function
void parse_saml_element_value_fixed(const char *xml_source, char *destination_buffer, size_t dest_capacity) {
    size_t index = 0;
    while (xml_source[index] != '<' && xml_source[index] != '\0') {
        // Explicit bounds check prevents memory corruption
        if (index >= (dest_capacity - 1)) {
            ns_log_error("SAML parser: Input element length exceeds maximum buffer size of %zu", dest_capacity);
            destination_buffer[dest_capacity - 1] = '\0';
            return;
        }
        destination_buffer[index] = xml_source[index];
        index++;
    }
    destination_buffer[index] = '\0';
}

Exploitation of CVE-2026-88779 is direct and does not require complex heap grooming or multi-stage delivery.

An attacker identifies a NetScaler Gateway or AAA Virtual Server configured with SAML policies. The attacker then delivers a crafted HTTP POST request containing an excessively long string inside the SAMLRequest or SAMLResponse parameters.

Once received by the virtual server, the gateway engine passes the request to the nsaaad daemon for processing. The parsing of the parameter triggers the memory corruption, causing nsaaad to crash. The exploitation workflow occurs in several stages:

1. The attacker transmits the malformed SAML payload to the target login endpoint.

2. The nsaaad daemon processes the payload, suffers a segmentation fault, and terminates.

3. The system watchdog daemon, pitboss, detects the crash and attempts to restart nsaaad automatically.

4. Repeated exploitation attempts exhaust the watchdog restart threshold, leading pitboss to declare a critical system state and execute a hard reboot of the physical or virtual appliance.

The impact of CVE-2026-88779 is amplified when deployed within High Availability (HA) configurations.

NetScaler HA configurations rely on active-passive clustering. If the active node crashes or reboots, the passive node detects the loss of heartbeat and immediately assumes the active role.

When an attacker targets an HA cluster, a cascading failover loop is initiated:

As Node B transitions to the active state, the automated attack script immediately shifts focus to the secondary node's IP address or continues sending requests to the virtual server's shared VIP. Node B is subjected to the same exploit, causing it to crash and reboot. By the time Node B fails, Node A has finished rebooting and is forced back into the active role, where it is immediately targeted and crashed again. This creates a perpetual loop of failovers and reboots, causing a total denial of service.

The definitive solution to CVE-2026-88779 is to update the NetScaler appliances to the patched firmware versions: 14.1-73.41, 13.1-64.28, or later.

For organizations unable to perform immediate upgrades, specific interim configurations must be deployed to block the exploitation attempts.

A Responder Policy can be implemented to drop malformed or highly long SAML structures. This policy must be bound with the -type AAA_REQUEST parameter to ensure it evaluates pre-authentication gateway traffic.

add responder action act_drop_saml respondwith "" -bypassSafetyCheck YES
add responder policy pol_block_saml "HTTP.REQ.BODY(10000).CONTAINS(\"SAMLRequest\") && HTTP.REQ.BODY(10000).LENGTH.GT(8000)" act_drop_saml
bind responder global pol_block_saml 100 -type AAA_REQUEST

Ensure that the Responder feature is enabled prior to binding. If the feature is disabled, the rules will fail to execute, leaving the system exposed. Additionally, apply the Web Application Firewall signatures (v24 or later) using NetScaler Console, ensuring close monitoring to prevent deployment conflicts on older firmware builds.