Citrix has urged administrators to immediately patch a critical NetScaler RCE flaw affecting NetScaler ADC and NetScaler Gateway. The vulnerability could allow attackers to execute code remotely or crash affected appliances.
Tracked as CVE-2026-107406, the issue stems from a memory overflow weakness. However, exposure depends on configuration: appliances must operate as a SAML Identity Provider or Service Provider to be vulnerable.
At the time of its bulletin, Citrix said it was unaware of any unmitigated exploits involving the vulnerability.
SAML Configuration Determines Exposure
NetScaler ADC manages application traffic, while NetScaler Gateway provides secure remote access to organizational resources.
The new vulnerability affects deployments configured to handle Security Assertion Markup Language authentication as either an Identity Provider or Service Provider.
An Identity Provider authenticates users, while a Service Provider relies on those authentication assertions to grant access.
Consequently, administrators need to check both their installed software version and their appliance configuration when assessing exposure.
Successful exploitation could result in remote code execution. Alternatively, attackers could trigger a denial-of-service condition that disrupts availability through device crashes.
Citrix Lists Fixed NetScaler Releases
Citrix recommends upgrading affected appliances to the appropriate fixed release for their software branch.
| Product or release branch | Fixed version |
|---|---|
| NetScaler ADC and Gateway 14.1 | 14.1-73.46 or later |
| NetScaler ADC and Gateway 13.1 | 13.1-64.29 or later within 13.1 |
| NetScaler ADC 14.1-FIPS | 14.1-73.46 FIPS or later within 14.1-FIPS |
| NetScaler ADC 13.1-FIPS and 13.1-NDcPP | 13.1.37.283 or later within the respective branch |
The company has asked affected customers to review its advisory and install the recommended updates as soon as possible.
Although Citrix has not reported evidence of active exploitation, its guidance treats the NetScaler RCE flaw as an urgent patching priority.
Internet Exposure Figures Do Not Establish Vulnerability
Shadowserver tracks more than 21,000 internet-facing IP addresses displaying NetScaler fingerprints.
Those observations include just over 1,500 Gateway instances and nearly 20,000 NetScaler ADC appliances.
However, these figures do not represent a confirmed count of vulnerable systems. Some devices may already have patches, lack the required SAML configuration or operate as honeypots.
The available data therefore shows the platform’s internet exposure without establishing how many deployments this specific flaw threatens.
Earlier NetScaler Flaws Have Attracted Attackers
The warning follows several NetScaler security incidents during 2026.
In March, Citrix urged customers to address CVE-2026-3055 and CVE-2026-4368. Attackers began exploiting those vulnerabilities days later.
Then, in September, the company released fixes for two actively exploited remote code execution zero-days, CVE-2026-88771 and CVE-2026-88772.
Those attacks involved custom web shells and tunneling malware. They also enabled credential theft, root access and movement into victims’ internal networks.
Earlier in October, Citrix issued emergency updates for CVE-2026-88779, initially described as a denial-of-service zero-day. Researchers and administrators subsequently reported that attackers could also use it for remote code execution.
These earlier incidents concern separate vulnerabilities and do not establish exploitation of CVE-2026-107406.
Previous Exploitation Adds Urgency to Updates
Since November 2021, CISA has listed 27 Citrix vulnerabilities in its Known Exploited Vulnerabilities catalog. Seven have links to ransomware attacks.
That history reinforces the importance of promptly addressing exposed NetScaler systems.
For the newly disclosed issue, Citrix’s recommended action is to identify affected SAML deployments and upgrade them to a fixed release.
0 responses to “Critical NetScaler RCE Flaw Prompts Urgent Citrix Patch Warning”