Science & Tech · Cybersecurity · 15 hrs ago
Citrix warns of critical flaw in patched NetScaler appliances
Citrix has disclosed a critical memory overflow in its NetScaler ADC and Gateway appliances.
The flaw can let an attacker cause a service outage or run code on an affected appliance.
It affects certain software builds when NetScaler is configured for SAML single sign-on, as an identity provider or service provider depending on the build.
Some affected builds are the ones Citrix released in September to fix other flaws, two of which had been exploited.
Citrix says it is not aware of any unmitigated exploits of this new flaw.
The company lists no workaround and urges affected customers to check its advisory and upgrade to recommended versions.
Citrix-managed cloud services are not affected because Citrix updates them itself.
Citrix disclosed CVE-2026-107406, a critical memory overflow flaw in NetScaler ADC and Gateway appliances.
The flaw can allow remote code execution or denial of service on appliances configured for SAML single sign-on.
It affects certain builds that had patched vulnerabilities exploited the previous month, as well as earlier builds.
Citrix rated the vulnerability 9.5 out of 10 under CVSS v4.0 and listed no workaround.
Citrix urged affected customers to review its advisory and upgrade to recommended versions.
- Who
- Citrix disclosed the flaw; users of affected NetScaler appliances may be exposed.
- What
- CVE-2026-107406 is a critical memory overflow that can lead to remote code execution or denial of service.
- When
- Citrix disclosed it on October 11, 2026.
- Where
- NetScaler ADC and NetScaler Gateway appliances, including some Secure Private Access hybrid deployments.
- Why
- A memory overflow affects appliances configured for SAML single sign-on; the sources do not state its cause.
This story does not have two clearly opposing sides.
We strongly urge affected customers to review the advisory and upgrade impacted NetScaler instances to the recommended versions as soon as possible,
There's yet another Citrix Netscaler vuln (new patch today) which allows unauth RCE,
As of the publication of the bulletin, Citrix is not aware of any unmitigated exploits of this vulnerability,
Citrix issued a bulletin covering eight vulnerabilities, including two that had been exploited as zero-days.
Citrix disclosed CVE-2026-88779, a SAML flaw that attackers had exploited to knock appliances offline.
Citrix disclosed CVE-2026-107406, a critical flaw in NetScaler appliances.
- Vulnerability
- CVE-2026-107406
- Severity
- CVSS v4.0 score of 9.5 out of 10.0
- Affected products
- NetScaler ADC and NetScaler Gateway
- Affected versions
- Builds before 14.1-73.46 and 13.1-64.29
- Exposed configuration
- SAML identity provider or service provider, depending on the build
- Workaround
- None listed
Sources
Related news
Yandex services disrupted after Ukrainian drone strikes on Russian data centers
Dropbox launches data access governance tool in Singapore
US seizes two China-linked hacking tools used against critical infrastructure
Canadian cybersecurity executive arrested in U.S. hacking case
Anthropic offers free AI vulnerability scans to open-source projects
FBI arrests another suspect linked to ShinyHunters jobs-site breach
New characters let lookalike domains bypass some browser checks
Canadian cybersecurity negotiator arrested in ShinyHunters investigation
Hackers use Bing redirects in Google ads to promote fake Claude installers
Amazon Bedrock flaw exposed AI agent credentials and source code
Canadian cybersecurity executive arrested on extortion-related charges
