Citrix urges admins to patch new NetScaler RCE flaw

Citrix is urging IT administrators to update affected NetScaler systems after disclosing a critical vulnerability that could allow remote code execution or cause a denial-of-service condition.

Tracked as CVE-2026-107406, the flaw stems from a memory overflow weakness. To be vulnerable, NetScaler ADC and NetScaler Gateway appliances must be configured as a Security Assertion Markup Language (SAML) Identity Provider (IdP) or Service Provider (SP).

Citrix said it was not aware of any unmitigated exploits as of the bulletin’s publication. The company urged affected customers to review its advisory and upgrade impacted instances to recommended versions as soon as possible.

Shadowserver tracks more than 21,000 internet-exposed IP addresses with NetScaler fingerprints, including just over 1,500 Gateway instances and nearly 20,000 NetScaler ADC appliances. The source says it is unclear how many are honeypots, have been patched, or use vulnerable configurations.

Citrix has warned about other NetScaler flaws exploited this year. In March, it urged customers to patch CVE-2026-3055 and CVE-2026-4368 before attackers began abusing them days later. In September, it issued updates for actively exploited RCE zero-days CVE-2026-88771 and CVE-2026-88772. Earlier this month, it released emergency updates for denial-of-service zero-day CVE-2026-88779, which researchers and administrators later said could also enable remote code execution.

CISA has flagged 27 actively exploited Citrix vulnerabilities since November 2021, including seven used in ransomware attacks.