cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

Citrix Patches Critical NetScaler Flaw That Could Enable Remote Code Execution

· Original article ↗

Summary

Citrix patched CVE-2026-107406, a critical NetScaler ADC and Gateway memory overflow that could enable remote code execution or denial of service in deployments configured as SAML identity or service providers. No in-the-wild exploitation was reported.

Key points

  • CVE-2026-107406 has a CVSS score of 9.5 and may cause remote code execution or denial of service under specific conditions.
  • Exploitation requires NetScaler ADC or Gateway to be configured as a SAML identity provider or service provider.
  • Citrix released patches and advised customers to upgrade affected instances, including NetScaler instances used in Secure Private Access Hybrid deployments.
  • Citrix said there was no evidence that CVE-2026-107406 had been exploited in the wild.
  • The article notes that three other NetScaler flaws—CVE-2026-88771, CVE-2026-88772, and CVE-2026-88779—are being actively exploited.

Article Details

Vulnerability Types
  • Memory overflow
Severity
Critical; CVSS 9.5 out of 10.0
Exploitation Status
not_reported
Exploit Availability
unknown
Patch Status
available

CVE

CVE-2026-107406"CVE-2026-107406 is a memory overflow vulnerability that may lead to remote code execution or denial-of-service under specific configuration conditions," Citrix said.

People

Alex BernierCredited by Citrix with discovering and reporting CVE-2026-107406 as part of the JPMorgan Chase XOR Team.Chew Keong TanCredited by Citrix with discovering and reporting CVE-2026-107406 as part of the JPMorgan Chase XOR Team.Maxim SuhanovCredited by Citrix with discovering and reporting CVE-2026-107406.Michael TuckerCredited by Citrix with discovering and reporting CVE-2026-107406 as part of the JPMorgan Chase XOR Team.

Vendors

CitrixCitrix has released patches for yet another critical security flaw impacting NetScaler ADC and NetScaler Gateway that could result in remote code execution or denial-of-service (DoS) under certain conditions.

Products

NetScaler ADCCitrix has released patches for yet another critical security flaw impacting NetScaler ADC and NetScaler Gateway that could result in remote code execution or denial-of-service (DoS) under certain conditions.NetScaler GatewayCitrix has released patches for yet another critical security flaw impacting NetScaler ADC and NetScaler Gateway that could result in remote code execution or denial-of-service (DoS) under certain conditions.Secure Private Access Hybrid"Secure Private Access Hybrid deployments using NetScaler instances are also affected by the vulnerability," Citrix warned. "Customers need to upgrade these NetScaler instances to the recommended NetScaler versions to

Related Articles