Citrix has issued an urgent security bulletin directing administrators to patch a critical vulnerability in NetScaler ADC and NetScaler Gateway appliances, the latest in a long string of high-severity flaws that have made these devices a favorite target for ransomware groups and state-backed attackers. Tracked as CVE-2026-107406, the vulnerability is a memory overflow weakness that, under specific configuration conditions, can allow unauthenticated remote code execution (RCE) or trigger a denial-of-service state that crashes the appliance. Given the role these appliances play as the front door to enterprise networks, the stakes could not be higher.<\/p>\n
At the technical level, CVE-2026-107406 arises from a memory overflow in the SAML (Security Assertion Markup Language) processing engine of NetScaler ADC and NetScaler Gateway. When these appliances are configured as a SAML Identity Provider (IdP) or Service Provider (SP), the flaw can be exploited to overwrite adjacent memory regions, potentially hijacking execution flow. Citrix\u2019s advisory (CTX697191) classifies the vulnerability as critical with a high CVSS score, reflecting both the ease of exploitation and the severity of the outcome: full remote code execution on the appliance, or a denial-of-service condition that disconnects all authenticated sessions.<\/p>\n
Importantly, the vulnerability is only exploitable when the NetScaler device is acting as a SAML IdP or SP. Not every NetScaler deployment runs SAML\u2014many use the appliances purely for load balancing or content switching\u2014but those that do are the backbone of federated authentication for thousands of organizations. This narrow exploitation scope does not diminish the urgency, because SAML-based single sign-on is widely adopted in government, healthcare, and financial services.<\/p>\n
Crucially, Citrix has stated that as of the publication of the advisory, it is not aware of any unmitigated exploits of this vulnerability in the wild. That statement carries a familiar caveat for security professionals: the absence of observed attacks today does not guarantee safety tomorrow. History with NetScaler shows that exploitation often starts days or weeks after a patch is released, and sometimes even before.<\/p>\n
CVE-2026-107406 is a memory overflow vulnerability in Citrix NetScaler ADC and NetScaler Gateway appliances that results in remote code execution or denial of service when the device is configured as a SAML Identity Provider or Service Provider. Attackers can trigger the overflow by sending specially crafted SAML requests, potentially allowing them to execute arbitrary code on the appliance or crash it. The vulnerability is classified as critical, and Citrix has released patched firmware versions that address the flaw.<\/p>\n
Citrix has provided a clear upgrade path for administrators. The following firmware versions contain the fix and are considered safe:<\/p>\n
Organizations using any earlier version\u2014especially those still running 12.x or earlier branches\u2014are urged to upgrade immediately. The advisory notes that no workaround or configuration change can fully mitigate the vulnerability; the only reliable fix is a firmware upgrade. This is a break-glass emergency for any IT team that has deferred NetScaler maintenance.<\/p>\n
Internet monitoring service Shadowserver has identified over 21,000 IP addresses with NetScaler fingerprints exposed on the public internet. Of those, just over 1,500 are identifiable as Gateway instances, while nearly 20,000 correspond to NetScaler ADC appliances. That number is a snapshot of potential vulnerability, but it is not a definitive count of exploitable targets. Some of those IPs are honeypots; others may already be patched. Still, the figure is sobering. It represents thousands of organizations that rely on NetScaler for remote access, application delivery, and identity federation\u2014and many of them may not yet have applied this patch.<\/p>\n
Shadowserver\u2019s data does not distinguish between SAML-enabled configurations and those that are not. However, given that SAML support is a standard feature in NetScaler, a large percentage of those exposed appliances are likely vulnerable if they are running unpatched firmware. The attack surface is further complicated by the fact that NetScaler Gateway appliances are frequently placed at the edge of corporate networks, handling VPN logins and authentication for remote workers. A successful compromise of a Gateway appliance can provide an attacker with direct access to internal resources, as has been demonstrated repeatedly in past campaigns.<\/p>\n
CVE-2026-107406 is not an isolated incident. Citrix NetScaler has been a persistent vector for attackers, and the pace of critical vulnerabilities has accelerated over the past two years. In March 2026, Citrix urged customers to patch two other NetScaler security issues\u2014CVE-2026-3055 and CVE-2026-4368\u2014only days before threat actors began exploiting them in active attacks<\/a>. That pattern of patch-and-exploit has become distressingly common.<\/p>\n In September 2026, Citrix released security updates for two more actively exploited NetScaler RCE zero-days, tracked as CVE-2026-88771 and CVE-2026-88772. Attackers used these flaws to deploy custom web shells and tunneling malware on victim networks, steal credentials, gain root access, and pivot into internal systems. These were not smash-and-grab operations; they were methodical intrusions that could stay hidden for weeks.<\/p>\n Earlier in October 2026\u2014just weeks before the current advisory\u2014Citrix issued emergency updates for a NetScaler denial-of-service zero-day (CVE-2026-88779) that security researchers and administrators later determined could also be exploited for remote code execution. So in a span of less than eight months, Citrix has patched at least six actively exploited vulnerabilities in the same product line, several of them with RCE potential.<\/p>\n