Cybersecurity
Citrix warns admins to patch NetScaler flaw
Citrix told administrators to update NetScaler ADC and NetScaler Gateway after finding CVE-2026-107406, a memory overflow issue that could permit remote code execution or denial of service on certain SAML-configured systems.
- Citrix warned that CVE-2026-107406 could let attackers run code remotely or force a denial-of-service condition.
- The issue affected NetScaler ADC and NetScaler Gateway only when they were configured as a SAML Identity Provider or Service Provider.
- Citrix said it was not aware of any unmitigated exploitation when it published the bulletin.
- Shadowserver said it tracked more than 21,000 internet-exposed IP addresses with NetScaler fingerprints, and CISA said it had flagged 27 actively exploited Citrix vulnerabilities since November 2021.
Citrix warned IT administrators to patch NetScaler ADC and NetScaler Gateway after identifying CVE-2026-107406. The company said the flaw was a memory overflow that could be used for remote code execution or to trigger a denial-of-service state, and that the risk applied only to appliances set up as a SAML Identity Provider or Service Provider.
Citrix said customers should move to the versions it recommended, including 14.1-73.46 and later, 13.1-64.29 and later for 13.1, 14.1-73.46 FIPS and later for 14.1-FIPS, and 13.1.37.283 and later for 13.1-FIPS and 13.1-NDcPP. It said it had no information at publication time showing unmitigated exploitation of the bug.
Shadowserver said it was tracking more than 21,000 IP addresses with NetScaler fingerprints visible on the internet. It said that figure included just over 1,500 Gateway instances and nearly 20,000 NetScaler ADC appliances, but it could not tell how many were honeypots, already patched, or still vulnerable.
Citrix also pointed to earlier NetScaler issues that had been attacked this year, including March vulnerabilities CVE-2026-3055 and CVE-2026-4368, September zero-days CVE-2026-88771 and CVE-2026-88772, and an emergency fix this month for CVE-2026-88779. CISA said it had flagged 27 Citrix vulnerabilities as actively exploited since November 2021, including seven linked to ransomware attacks.
Named in this story
Companies
- Citrix
- warned customers to patch the flaw and issued version guidance
Organisations
- Shadowserver
- tracked exposed NetScaler systems on the internet
Governments and agencies
- CISA
- said it had flagged 27 exploited Citrix vulnerabilities since November 2021
Products and systems
- NetScaler ADC
- one of the affected appliance lines
- NetScaler Gateway
- the other affected appliance line
- CVE-2026-107406
- the vulnerability Citrix identified
How the source tells it
The article is urgent and cautionary, using repeated patch warnings, a critical-flaw label, and references to exposed devices and earlier abuse.
- urgency repeated instructions to patch at once and to upgrade as soon as possible
- alarm a critical vulnerability is paired with remote code execution, denial of service, and a large exposed-device count