Citrix Advises Immediate Action on Critical NetScaler RCE Flaw
Citrix has issued an urgent warning to IT administrators to patch systems immediately against a newly identified critical vulnerability affecting NetScaler ADC networking appliances and NetScaler Gateway secure remote access solutions. The flaw, tracked as CVE-2026-107406, arises from a memory overflow weakness that could allow attackers to achieve remote code execution (RCE) on targeted devices or trigger a denial-of-service condition leading to system crashes.
Conditions for Exploitability
For a NetScaler ADC or NetScaler Gateway appliance to be vulnerable to CVE-2026-107406, it must be configured to operate as either a Security Assertion Markup Language (SAML) Identity Provider (IdP) or a Service Provider (SP). Citrix emphasized that systems not configured in these roles are not affected by this specific vulnerability.
Recommended Mitigation and Patch Versions
Citrix strongly urges affected customers to review the security advisory and upgrade impacted NetScaler instances to the recommended versions without delay. The company confirmed that, as of the bulletin's publication, there are no known unmitigated exploits of CVE-2026-107406 in the wild.
Administrators should upgrade to the following fixed releases:
- NetScaler ADC and NetScaler Gateway 14.1-73.46 and later
- NetScaler ADC and NetScaler Gateway 13.1-64.29 and later releases of the 13.1 train
- NetScaler ADC 14.1-FIPS 14.1-73.46 FIPS and later releases of 14.1-FIPS
- NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.283 and later releases of 13.1-FIPS and 13.1-NDcPP
Internet Exposure and Risk Context
According to Shadowserver, an internet threat watchdog, over 21,000 IP addresses with NetScaler fingerprints are exposed on the public internet. This includes approximately 1,500 NetScaler Gateway instances and nearly 20,000 NetScaler ADC appliances. However, Citrix noted that it is currently unknown how many of these exposed systems are honeypots, have already been patched, or are configured in a vulnerable SAML IdP or SP mode.
Recent History of Exploited NetScaler Vulnerabilities
While Citrix has not observed active exploitation of CVE-2026-107406 at this time, the company highlighted a pattern of threat actors quickly abusing recently disclosed NetScaler flaws. In March, Citrix warned customers to patch CVE-2026-3055 and CVE-2026-4368, noting that threat actors began exploiting them shortly after the advisory.
In September, the company released updates for two actively exploited zero-day RCE vulnerabilities—CVE-2026-88771 and CVE-2026-88772—which allowed attackers to deploy web shells, deploy tunneling malware, steal credentials, gain root access, and move laterally within victim networks.
Earlier in October, Citrix issued emergency patches for a denial-of-service zero-day flaw, CVE-2026-88779, which researchers and administrators later determined could also be chained to achieve remote code execution under certain conditions.
CISA’s Ongoing Concern Over Citrix Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has tracked 27 actively exploited Citrix vulnerabilities since November 2021. Of these, seven have been linked to ransomware campaigns, underscoring the persistent risk posed by unpatched NetScaler systems in enterprise environments.
"We strongly urge affected customers to review the advisory and upgrade impacted NetScaler instances to the recommended versions as soon as possible,"
Citrix reiterated in its advisory, emphasizing the importance of timely patching despite the absence of confirmed wild exploitation for CVE-2026-107406 at the time of the announcement.
Source: BleepingComputer