Vulnerabilities · Application Security
Citrix urges urgent patching for critical NetScaler vulnerability
Citrix has fixed a critical flaw in NetScaler ADC and Gateway that could let attackers run code or disrupt services. No attacks are known yet, but users are urged to patch immediately.
Ross GrantUpdated 3 min read
The short version
Citrix has patched a serious bug in its NetScaler ADC and Gateway products. If left unpatched, attackers could take control or shut down affected devices. Only systems set up for SAML single sign-on are at risk. Citrix says there are no known attacks yet, but urges users to update now.
What happened?
Citrix has fixed a critical vulnerability (CVE-2026-107406) in NetScaler ADC and Gateway. The flaw could let attackers run code or disrupt services if the device is set up for SAML. No attacks are known yet, but Citrix urges immediate patching.
What is the Citrix NetScaler vulnerability?
Citrix has released patches for a critical security flaw in its NetScaler ADC and NetScaler Gateway products. The vulnerability, tracked as CVE-2026-107406, is a memory overflow bug. If exploited, it could let an attacker run code remotely on the device (remote code execution, or RCE) or cause a denial-of-service (DoS), making the service unavailable. The flaw has a CVSS score of 9.5, which is considered critical [SecurityWeek (opens in a new tab)][The Hacker News (opens in a new tab)][Security Affairs (opens in a new tab)].
Who is affected?
The vulnerability only affects NetScaler ADC and NetScaler Gateway appliances that are configured as a SAML Service Provider (SP) or SAML Identity Provider (IdP). SAML (Security Assertion Markup Language) is a protocol used for single sign-on (SSO) authentication. If your NetScaler is not set up for SAML, this flaw does not affect you.
To check if your device is at risk, look in the configuration for entries like add authentication samlAction (for SP) or add authentication samlIdPProfile (for IdP). Secure Private Access Hybrid deployments using NetScaler are also affected and need to be updated.
What versions are vulnerable and what should you do?
The affected versions include:
- NetScaler ADC and Gateway between 14.1-73.37 and 14.1-73.41
- NetScaler ADC 14.1-FIPS between 14.1-73.37 FIPS and 14.1-73.41 FIPS
- NetScaler ADC and Gateway between 13.1-64.23 and 13.1-64.28
- NetScaler ADC 13.1-FIPS between 13.1-NDcPP 13.1-37.279 and 13.1-37.282
Any NetScaler ADC or Gateway configured as a SAML SP or IdP and running an affected version is vulnerable. Citrix has provided fixes in:
- 14.1-73.46 and later
- 13.1-64.29 and later
- 14.1-73.46 FIPS and later
- 13.1.37.283 (13.1-FIPS and 13.1-NDcPP) and later
Citrix strongly urges all customers to upgrade to these versions as soon as possible. There is no evidence yet of attackers exploiting this flaw, but similar NetScaler vulnerabilities have been targeted in the past.
Recent context: other NetScaler vulnerabilities
This warning comes just after Citrix addressed several other serious flaws in NetScaler. In the past weeks, three other vulnerabilities (CVE-2026-88771, CVE-2026-88772, and CVE-2026-88779) were patched, some of which were already being exploited. These earlier bugs also allowed remote code execution or denial-of-service and were used in attacks against government, financial, education, and professional services organisations.
Practical advice for defenders
If you manage NetScaler appliances, check your configuration for SAML settings. If affected, patch immediately. Even if you are not currently using SAML, review your deployment to confirm. Monitor Citrix advisories for updates and consider reviewing your patch management process to ensure critical fixes are applied quickly. Attackers often move fast once a vulnerability is public.
What happens next?
At this time, there are no known attacks using CVE-2026-107406. However, given the history of NetScaler vulnerabilities being exploited soon after disclosure, there is a real risk if patches are not applied. Organisations that delay patching could face remote attacks or service outages. Security teams should prioritise this update and review their monitoring for signs of suspicious activity on NetScaler devices.
Claimed vs confirmed
- Confirmed
No known attacks exploiting CVE-2026-107406 at the time of publication.
All sources report that Citrix is not aware of any exploits in the wild as of the advisory.
The impact
- Money
- If exploited, organisations could face service outages and possible regulatory fines. Under UK GDPR, fines can reach £17.5m or 4% of global turnover for serious breaches.
- Reputation
- A successful attack could damage trust in affected organisations, especially as NetScaler is used in critical infrastructure.
- Customers
- Customers using NetScaler for SAML authentication could face service disruption or data compromise if the flaw is exploited. Patching is the best protection.
Why it matters
NetScaler is widely used for secure remote access and load balancing. If attackers exploit this flaw, they could take over or disrupt critical business services. Organisations using SAML on NetScaler should patch quickly to avoid risk.
How does it work?
The vulnerability is a memory overflow bug. If an attacker can trigger it, they may be able to run code remotely (remote code execution) or cause the device to crash (denial-of-service). It only affects NetScaler devices configured as SAML Service Provider or Identity Provider.
Key points
- Citrix NetScaler ADC and Gateway have a critical vulnerability (CVE-2026-107406).
- Only devices set up for SAML single sign-on are affected.
- No attacks are known yet, but patching is urgent.
- Several other NetScaler flaws have recently been exploited.
- Check your configuration and update to the fixed versions now.
Sources
SecurityWeek
Reference
The Hacker News
Reference
Security Affairs
Reference
