Citrix has released fixes for a critical vulnerability in NetScaler ADC and NetScaler Gateway that could let attackers run code on affected appliances, and is urging customers to upgrade immediately. The flaw was reported by BleepingComputer, The Hacker News and SecurityWeek on October 9.
The vulnerability
Tracked as CVE-2026-107406, the bug carries a CVSS score of 9.5 out of 10, according to The Hacker News. Citrix describes it as a memory overflow that “may lead to remote code execution” or to a denial-of-service condition that crashes the appliance. A memory overflow happens when software writes more data into a memory area than it was built to hold, which can corrupt neighboring data and, in the worst case, let an attacker take control of the program.
The flaw can only be exploited on appliances configured for SAML, either as an identity provider (IdP) or a service provider (SP). SAML is the standard many organizations use for single sign-on, so one login can grant access to many applications. Citrix’s advisory says administrators can check their configuration for these entries:
- SAML SP:
add authentication samlAction - SAML IdP:
add authentication samlIdPProfile
Secure Private Access hybrid deployments that use NetScaler instances are also affected.
Fixed versions
- NetScaler ADC and NetScaler Gateway 14.1-73.46 and later
- NetScaler ADC and NetScaler Gateway 13.1-64.29 and later 13.1 releases
- NetScaler ADC 14.1-FIPS 14.1-73.46 FIPS and later 14.1-FIPS releases
- NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.283 and later releases
“Customers need to upgrade these NetScaler instances to the recommended NetScaler versions to address the vulnerability,” Citrix said.
No exploitation seen yet
Citrix said it “is not aware of any unmitigated exploits of this vulnerability,” and there is no public evidence of attacks at this time. The flaw was reported by Michael Tucker, Chew Keong Tan and Alex Bernier of the JPMorgan Chase XOR Team, and by Maxim Suhanov.
Even so, the clock matters. NetScaler appliances are a frequent target, and the Shadowserver Foundation tracks more than 21,000 NetScaler fingerprints exposed online, including nearly 20,000 ADC appliances and just over 1,500 Gateway instances. According to BleepingComputer, CISA has flagged 27 actively exploited Citrix vulnerabilities since November 2021, seven of them used in ransomware attacks.
Three other NetScaler flaws are already under active exploitation this autumn: CVE-2026-88771 and CVE-2026-88772, which we covered when Citrix NetScaler was hit by two actively exploited zero-days, and the denial-of-service zero-day CVE-2026-88779.
Sources
- Citrix: Security bulletin CTX697191
- The Hacker News: Citrix Patches Critical NetScaler Flaw That Could Enable RCE in SAML Deployments (October 9, 2026)
- BleepingComputer: Citrix warns admins to patch new NetScaler RCE flaw immediately (October 9, 2026)
