Citrix bulletin CTX697191 (Oct 8): memory overflow leading to RCE or DoS when NetScaler ADC/Gateway is configured as a SAML SP or IdP (CVSS v4 9.5). Builds 14.1-73.37 to 73.41 and 13.1-64.23 to 64.28 (the fixes for KEV-listed CVE-2026-88779) are still affected when acting as a SAML IdP; older builds are affected as SP or IdP. Fixed: 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS, 13.1-37.283 FIPS/NDcPP. Citrix said it was not aware of unmitigated exploits at publication; CISA added it to its NetScaler alert on Oct 9, but it is not on KEV. Some X posts call it exploited; we found no primary confirmation. NetScaler already has four KEV entries since Sept 9 (CVE-2026-19490, -88771, -88772, -88779).