Citrix Urges Admins to Patch New NetScaler RCE Flaw at Once

Citrix has urged IT administrators to update their equipment immediately because of a new critical vulnerability affecting NetScaler ADC networking appliances and NetScaler Gateway remote-access gateways.

The flaw

Tracked as CVE-2026-107406, the vulnerability stems from a memory overflow weakness. An attacker can exploit it to run arbitrary code (RCE) on a targeted device or to force it into a denial-of-service state that may cause crashes.

Only devices configured as a SAML Identity Provider (IdP) or Service Provider (SP) are affected.

"We strongly urge affected customers to review the advisory and upgrade impacted NetScaler instances to the recommended versions as soon as possible," the company said. As of the bulletin's publication, Citrix was not aware of any unmitigated exploits of the vulnerability.

Recommended versions

Citrix advises upgrading vulnerable appliances to: NetScaler ADC and NetScaler Gateway 14.1-73.46 and later; NetScaler ADC and NetScaler Gateway 13.1-64.29 and later in the 13.1 branch; NetScaler ADC 14.1-FIPS 14.1-73.46 FIPS and later; and NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.283 and later.

The scale

The internet watchdog Shadowserver tracks over 21,000 IP addresses carrying NetScaler fingerprints exposed online — just over 1,500 of them Gateway instances and nearly 20,000 NetScaler ADC appliances. It remains unclear how many are honeypots, have already been patched, or actually run a vulnerable configuration.

A worrying backdrop

Though there are no signs of exploitation yet, the NetScaler line has repeatedly been a target this year. In March, Citrix urged customers to fix two flaws (CVE-2026-3055 and CVE-2026-4368) just days before attacks began. In September, it shipped updates against two actively exploited RCE zero-days that let attackers deploy web shells and tunneling malware, steal credentials, and gain root access. Earlier this month, Citrix released an emergency fix for a denial-of-service zero-day that researchers later found could also be used for code execution.

Since November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged 27 actively exploited Citrix vulnerabilities, seven of them abused in ransomware attacks.

Source: Bleeping Computer