Citrix urges patching of critical NetScaler flaw

Citrix on Thursday urged customers to patch a critical vulnerability in NetScaler ADC and NetScaler Gateway appliances. Tracked as CVE-2026-107406, the memory-overflow flaw has a CVSS score of 9.5 and can enable remote code execution or denial-of-service attacks.

The vulnerability affects appliances configured as a SAML service provider or SAML identity provider when specific configuration conditions are present. Secure Private Access Hybrid deployments that use NetScaler are affected as well.

Fixes are available in NetScaler ADC and Gateway versions 14.1-73.46 and 13.1-64.29. Patches are also included in version 14.1-73.46 FIPS and version 13.1.37.283 for 13.1-FIPS and 13.1-NDcPP.

Citrix’s security bulletin reported no known unmitigated exploitation of CVE-2026-107406 at the time of publication. The company urged customers to update affected instances as soon as possible.

The warning came days after Citrix disclosed CVE-2026-88779, a zero-day vulnerability in NetScaler that can cause denial of service. A week earlier, Citrix patched CVE-2026-88771, which can enable remote code execution, and CVE-2026-88772, which can enable remote code execution or denial of service.

The two earlier zero-day vulnerabilities have been exploited in attacks against organizations in the government, financial services, education, legal and professional services sectors.