Citrix NetScaler administrators are reporting repeated appliance crashes and forced reboots after applying emergency updates for recently disclosed zero-day vulnerabilities, with the disruption now linked to a newly observed issue affecting SAML authentication deployments.
The incidents have been reported on internet-facing NetScaler ADC and Gateway appliances running patched releases, including version 14.1-73.37.
Multiple administrators said malicious or malformed SAML-related requests appeared to crash the nsaaad authentication service, triggering failovers or full appliance reboots.
New Citrix NetScaler SAML Flaw
Reddit said the activity has not been independently confirmed as successful exploitation of the new SAML issue, but accounts of payload-bearing requests, attempted script downloads, and repeated service failures have raised concerns that attackers are probing exposed systems.
NetScaler engineering and support teams said they are tracking an issue associated with customer-managed deployments that use SAML authentication alongside Gateway or AAA functionality.
The apparent impact is configuration-dependent. Community reports indicate that NetScaler appliances using SAML service-provider configurations may be especially susceptible to nsaaad crashes after receiving crafted authentication traffic.
One administrator reported seeing an apparent command intended to download a script in appliance logs, although the download did not succeed. Another said a payload delivered through the username field caused the authentication daemon to crash after only a handful of requests.
This behavior can create a serious availability problem even where no compromise occurs. Repeated authentication-service crashes may cause a high-availability pair to fail over, interrupt remote access, and force administrators to take exposed gateways offline while investigating.
The reports follow Citrix’s emergency response to CVE-2026-88771 and CVE-2026-88772, two critical NetScaler flaws that Citrix says have been exploited against unmitigated deployments.
CVE-2026-88771 is an improper-input-validation vulnerability that lets an unauthenticated attacker execute arbitrary commands, while CVE-2026-88772 is a memory-overflow issue that may enable remote code execution or denial of service where DTLS is enabled. Both carry a CVSS v4 score of 9.5.
Citrix lists NetScaler ADC and Gateway version 14.1-73.37 and later, as well as 13.1-64.23 and later, as fixed releases for the previously disclosed zero-days.
The SAML-related crashes reported after installation therefore appear to be a distinct issue, not evidence that the original patch has been bypassed.
Organizations operating externally accessible NetScaler Gateway or AAA virtual servers should immediately review whether SAML authentication actions are configured, preserve logs and crash artifacts before restarting affected devices, and closely monitor for repeated nsaaad failures.
Administrators should also verify the installed build on both active and standby HA nodes, confirm that enhancedISNgeneration is enabled where advised by Citrix, and follow the vendor’s forthcoming SAML-specific remediation guidance.
Reports of reboots alone should not be treated as proof of compromise, but the combination of active scanning, malformed authentication traffic, and appliance crashes warrants incident-response handling until forensic analysis rules out intrusion.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
