Citrix Urges Immediate Patching of Critical NetScaler Vulnerability

Citrix has issued an urgent advisory about a critical flaw affecting NetScaler ADC, NetScaler Gateway, and Secure Private Access Hybrid deployments built on NetScaler. The vulnerability, CVE-2026-107406, scores 9.5 on CVSS and stems from a memory overflow that could allow an attacker to trigger remote code execution or crash the appliance through denial-of-service, specifically on devices set up as SAML SP or SAML IdP under certain configurations. Citrix says it has no evidence of active exploitation so far, but is pressing customers to upgrade immediately to the fixed releases—NetScaler ADC and Gateway 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS, or 13.1.37.283 for the FIPS/NDcPP branches. This disclosure follows closely on the heels of another NetScaler zero-day, CVE-2026-88779, and two previously exploited zero-days, CVE-2026-88771 and CVE-2026-88772, which were used in attacks against government, financial, education, legal, and professional services targets.