Summary
Citrix has patched a new zero-day vulnerability in NetScaler’s SAML authentication handler that is being actively exploited in attacks. The vulnerability is distinct from CVE-2026-62106 and CVE-2026-62107 documented in TTO-2026-0927-173 and its follow-up bulletins. The new SAML zero-day affects NetScaler’s implementation of the SAML authentication protocol, which organizations use to integrate NetScaler with enterprise identity providers for single sign-on. Citrix has released an emergency patch and confirmed active exploitation. This is the third distinct zero-day class disclosed in Citrix NetScaler in September-October 2026.
Timeline
| Date | Event |
|---|---|
| Sep 26, 2026 | Citrix patches CVE-2026-62106 and CVE-2026-62107; TTO-2026-0927-173 published |
| Sep 28, 2026 | CISA sets October 1 federal deadline; TTO-2026-0928-176 published |
| Sep 30, 2026 | Web shells confirmed on compromised appliances; TTO-2026-0930-187 published |
| Oct 5, 2026 | Citrix patches new NetScaler SAML zero-day; confirms active exploitation; BleepingComputer reports; TTO-2026-1005-203 published |
What Happened
The new SAML zero-day is a separate vulnerability class from the previously documented NetScaler zero-days. CVE-2026-62106 was an unauthenticated RCE in the management interface; the SAML vulnerability affects a different component — the SAML assertion processing logic used when NetScaler acts as a SAML service provider in enterprise SSO deployments. A vulnerability in SAML assertion processing can allow an attacker to forge or manipulate SAML assertions, potentially bypassing authentication entirely and gaining access to applications protected by NetScaler Gateway without valid credentials.
The concentration of zero-days in NetScaler across a two-week window is operationally significant. Organizations that patched CVE-2026-62106 and CVE-2026-62107, conducted forensic review for web shells, and considered their NetScaler remediation complete must now apply an additional emergency patch for the SAML zero-day. Any NetScaler appliance that was internet-exposed during the window between the SAML zero-day’s exploitation and today’s patch release should be treated as potentially compromised and subjected to forensic review, consistent with the guidance issued after CVE-2026-62106. Citrix NetScaler has now required three separate emergency patch cycles in under two weeks.
Domain Intelligence
citrix.com — 87.0
citrix.com scores at 87.0 in the high-trust range. Score unchanged from prior NetScaler bulletins. The T6_CONSUMER_REPUTATION_PENALTY flag reflects consumer-facing reputation signals and does not alter the enterprise trust assessment.