Thesis: The CVE number is not the triage. Whether the appliance is configured as a SAML SP or IdP defines whether this overflow is in your blast radius. Config-as-code and change control (CC7 / CC8 as lesson labels) are how you know before the bulletin, not after.
What we checked first
Public bulletins first: The Hacker News (2026-10-05), Citrix CTX697174, and CISA KEV (federal deadline 2026-10-07 — a severity signal for private companies, not a binding SLA). See also CISA’s add alert.
CVSS 8.7 memory overflow → denial of service on customer-managed NetScaler ADC/Gateway when SAML SP or IdP preconditions hold. Citrix’s analysis is service availability impact; it is not a substitute for your own forensics program.
This is not the same wave as CVE-2026-88771 / CVE-2026-88772 web-shell and post-exploitation reporting. Keep those triage queues separate.
The working shape
Synthetic CLI only (device ns-lab-01). These two show commands ask whether SAML SP or IdP auth profiles are present — the precondition that puts this appliance in scope for CVE-2026-88779 until patched.
# ns-lab-01 — triage precondition (synthetic)
show authentication samlAction
show authentication samlIdPProfileIf either profile class is present, this appliance is in scope until patched. Pins from Citrix: 14.1-73.41+, 13.1-64.28+ (and matching FIPS / NDcPP builds per bulletin). Empty SAML auth config → a different blast radius for this CVE — still patch on schedule; do not invent “out of scope forever” from one show.
Lesson: the control that would have made triage boring is knowing SAML SP/IdP config as code (CC7 / CC8 labels) — not rediscovering it from a zero-day thread.
Checklist
- Confirm SAML SP/IdP with show authentication samlAction / show authentication samlIdPProfile (or IaC equivalent) before arguing scope.
- Pin builds to Citrix’s fixed trains; treat FIPS/NDcPP as matching lines, not a free pass.
- Keep CVE-2026-88779 availability triage separate from 88771/88772 web-shell response.
- Read CISA KEV deadlines as severity signal for private orgs — not as your only clock.
- Name CC7/CC8 as config-change lessons; do not quote unpublished matrix rows.
Related: an empty matrix is not a green board · the pack carries the brief label, not a sixth rung. How we deliver: methodology.
Engineering commentary only — not audit, legal, or certification advice. Sources linked above; no unpublished IoCs or exploit steps.