Citrix is calling on administrators to deploy patches without delay for a critical vulnerability discovered in NetScaler ADC networking appliances and NetScaler Gateway remote access solutions. The flaw, identified as CVE-2026-107406, originates from a memory overflow condition that could allow attackers to execute arbitrary code on affected systems or cause denial-of-service crashes.
The vulnerability only affects devices running NetScaler ADC or NetScaler Gateway when configured as a SAML Identity Provider or Service Provider. According to Citrix, "We strongly urge affected customers to review the advisory and upgrade impacted NetScaler instances to the recommended versions as soon as possible. As of the publication of the bulletin, Citrix is not aware of any unmitigated exploits of this vulnerability."
Organizations should upgrade their appliances to one of the following patched versions:
- NetScaler ADC and NetScaler Gateway 14.1-73.46 and later
- NetScaler ADC and NetScaler Gateway 13.1-64.29 and later releases of 13.1
- NetScaler ADC 14.1-FIPS 14.1-73.46 FIPS and later releases of 14.1-FIPS
- NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.283 and later releases of 13.1-FIPS and 13.1-NDcPP
Security monitoring firm Shadowserver has identified over 21,000 internet-exposed IP addresses running NetScaler software, comprising approximately 1,500 Gateway instances and nearly 20,000 ADC appliances. The organization cannot determine how many of these systems are production devices, have already received patches, or run vulnerable configurations.
Pattern of recent NetScaler exploits
Although Citrix has found no evidence of CVE-2026-107406 being exploited in active attacks, the company has documented multiple other NetScaler vulnerabilities that threat actors have weaponized throughout the year. In March, Citrix released patches for CVE-2026-3055 and CVE-2026-4368 only days before attackers began exploiting them in the wild.
September brought two additional zero-day remote code execution flaws, CVE-2026-88771 and CVE-2026-88772, which attackers have actively leveraged to deploy malicious web shells, tunneling malware, harvest credentials, obtain root privileges, and move laterally through victim networks. Earlier this month, Citrix released emergency fixes for CVE-2026-88779, a denial-of-service zero-day that researchers subsequently demonstrated could also enable remote code execution.
The U.S. Cybersecurity and Infrastructure Security Agency has documented 27 Citrix vulnerabilities under active exploitation since November 2021, with seven of those being leveraged in ransomware campaigns.