Citrix Warns Admins to Patch New NetScaler RCE Flaw Immediately
The flaw can trigger remote code execution or denial of service in SAML configurations, and Citrix rates it 9.5 on the CVSS v4.0 scale.
- Citrix is urging customers to patch CVE-2026-107406, a critical remote code execution vulnerability affecting NetScaler ADC and NetScaler Gateway with a CVSS v4.0 score of 9.5 and impacting SAML configurations.
- Researchers Michael Tucker, Chew Keong Tan, and Alex Bernier at JPMorgan Chase's XOR Team, along with Maxim Suhanov, discovered the flaw, which Citrix classifies as CWE-119 involving improper restriction of operations within a memory buffer.
- Unlike the exploited flaw CVE-2026-88779 disclosed last Friday carrying an 8.7 severity score, Citrix has not identified CVE-2026-107406 as currently exploited, though both involve memory overflows in SAML configurations.
- Customers must manually update their own NetScaler deployments to address the risk, while Citrix handles necessary updates for managed cloud services and Adaptive Authentication environments.
- The disclosure follows weeks of security releases, including a campaign exploiting CVE-2026-88772 identified by Google researchers that has targeted organizations across North America and Europe in finance, government, education, and legal sectors.
13 Articles
13 Articles
Citrix warns admins to patch new NetScaler RCE flaw immediately
Citrix has warned IT administrators to patch systems immediately against a new critical vulnerability affecting NetScaler ADC networking appliances and NetScaler Gateway secure remote access solutions. [...]
The critical breach scored 9.5 points, and the attack doesn't need an account.
CVE-2026-107406: Citrix Fixes Critical NetScaler ADC and Gateway Vulnerability
CVE-2026-107406: Citrix Fixes Critical NetScaler ADC and Gateway Vulnerability Pierluigi Paganini October 09, 2026 Citrix patched CVE-2026-107406, a critical NetScaler ADC and Gateway flaw that could allow remote code execution or denial-of-service attacks. Citrix has released security updates to fix CVE-2026-107406 (CVSS score of 9.5), a critical flaw affecting NetScaler ADC and NetScaler Gateway that
Citrix has launched urgent corrections for vulnerability in Citrix NetScaler (CVE-2026-107406), with CVSS 9.5. Learn if your SAML infrastructure is affected.
Coverage Details
Bias Distribution
- 100% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
