Citrix warns admins to patch new NetScaler RCE flaw immediately

Citrix is urging administrators to immediately update NetScaler ADC and NetScaler Gateway appliances after disclosing a new critical flaw tracked as CVE-2026-107406. The bug is caused by a memory overflow issue that could let attackers achieve remote code execution or crash the device through a denial-of-service condition. Devices are only at risk if they are set up as a SAML Identity Provider or Service Provider. Citrix says it has no evidence of active exploitation so far, but it recommends upgrading to NetScaler ADC/Gateway 14.1-73.46 or later, 13.1-64.29 or later, 14.1-FIPS 14.1-73.46 or later, and 13.1-FIPS/13.1-NDcPP 13.1.37.283 or later, noting that over 21,000 internet-facing NetScaler instances remain exposed and that similar flaws have been repeatedly targeted by attackers throughout the year.