A week after the discovery of the PitScaler vulnerability, a new zero-day flaw, CVE-2026-88779, has caused updated Citrix NetScaler devices to crash repeatedly, forcing companies to re-patch their systems. Citrix describes the issue as a denial of service, although the possibility of code execution has not been ruled out. This vulnerability has emerged just days after the company released patches to address earlier security concerns, adding to the pressure on IT administrators. Citrix NetScaler is a device that serves as a remote access gateway for enterprise employees and can also manage SAML authentication, a method used to verify user identities across different systems. In recent days, administrators have reported that updated NetScaler devices with versions 14.1-73.37, which were intended to fix previous issues, have been restarting in a loop. This has caused significant disruption for businesses relying on these systems. According to SecurityWeek, prior to the release of the patches, Citrix's technical support teams were experiencing long delays. Temporary workarounds did not prevent the crashes and repeated restarts. Some Citrix customers had to unplug their hardware during the first wave of vulnerabilities. Even those who installed the PitScaler patch are not spared if they use SAML, as Citrix has released a new patch and is asking users to update a second time in a very short period of time. Cybersecurity researcher Kevin Beaumont observed one of his honeypots (which was patched) running a malicious binary retrieved from the web. Another administrator found in his logs user names containing shell commands intended to download a file and execute it. However, his logs do not prove that these commands actually ran. In June, Citrix communicated about CVE-2026-8452, another memory overflow on the SAML side, which could cause "unpredictable behavior" or a denial of service. According to the note from the Cloud Security Alliance, watchTowr demonstrated in August that this vulnerability actually allowed for root code execution without authentication. Although nothing indicates that it is the same bug here (the crash today is the nsaaad process looping), it is not the first time that the explanation "it's just a denial of service" has been debunked. Beaumont also recalls that the CVE-2025-6543 followed the same path. Citrix has released updates that fix the vulnerability and also offers lists of malicious IP address blocking. CISA has added the vulnerability to its catalog on October 4, with a required correction deadline of October 7 for U.S. federal agencies. It is the sixth NetScaler vulnerability exploited that it has listed this year. The vulnerability only affects appliances configured as service provider (SP) or identity provider (IdP) SAML. To check if affected, look in the configuration for a line add authentication samlAction or add authentication samlIdPProfile. If present, users will need to install at least version 14.1-73.41 or 13.1-64.28 according to their branch (or 14.1-73.41 FIPS, or 13.1-37.282 for FIPS and NDcPP in 13.1) of NetScaler, as indicated by the Citrix bulletin.