Citrix tells admins to patch NetScaler flaw scoring 9.5 for RCE

Citrix warned IT administrators on 9 October 2026 to patch NetScaler appliances immediately against CVE-2026-107406, a critical memory-overflow flaw that carries a CVSS v4.0 score of 9.5 and can yield remote code execution on targeted devices. The vulnerability affects NetScaler ADC networking appliances and NetScaler Gateway secure remote access solutions, and can also trigger denial-of-service crashes.bleepingcomputer.com

The flaw matters because remote code execution lets an attacker run their own commands on a network appliance that sits in front of internal systems, and NetScaler Gateway is a common remote-access entry point. What is new is that this is a fresh disclosure with a 9.5 severity score, arriving after weeks of NetScaler flaws that attackers have already exploited in the wild.theregister.com

What the flaw allows

Citrix classified the flaw as CWE-119, improper restriction of operations within a memory buffer, meaning the software writes or reads past the bounds of the memory it allocated. That overflow can corrupt adjacent data, and in this case attackers can turn it into remote code execution or a denial-of-service state that crashes the device.

To be vulnerable, appliances must be configured as a Security Assertion Markup Language (SAML) identity provider (IdP) or service provider (SP), a standard for exchanging authentication data between applications. The affected configurations depend on the build: older builds are vulnerable in either role, while some more recent builds are affected only in the identity provider configuration.

Citrix listed the fixed versions: NetScaler ADC and NetScaler Gateway 14.1-73.46 and later, and 13.1-64.29 and later releases of 13.1. For federal-grade builds, NetScaler ADC 14.1-FIPS 14.1-73.46 FIPS and later, plus 13.1-FIPS and 13.1-NDcPP 13.1.37.283 and later, need updating. Secure Private Access Hybrid deployments using NetScaler instances also require patching.

Which configurations are exposed

Internet threat watchdog Shadowserver tracks over 21,000 IP addresses with NetScaler fingerprints exposed on the internet, including just over 1,500 Gateway instances and nearly 20,000 NetScaler ADC appliances. That count does not say how many are honeypots, already patched, or running vulnerable configurations, so the true number of exposed and vulnerable systems remains unknown.

Where the exposure numbers come from

Citrix said it handles the necessary updates for its managed cloud services and Adaptive Authentication, while customers must update their own deployments. The company urged affected customers to review the advisory and upgrade impacted NetScaler instances to the recommended versions as soon as possible. As of the publication of the bulletin, Citrix said it is not aware of any unmitigated exploits of this vulnerability, and did not say whether it had been exploited as a zero-day before disclosure. Citrix credited Michael Tucker, Chew Keong Tan, and Alex Bernier at JPMorgan Chase's XOR Team, along with Maxim Suhanov, with discovering the flaw.

The warning follows a run of NetScaler flaws: in March, Citrix urged patching CVE-2026-3055 and CVE-2026-4368 days before attackers abused them; in September it fixed two actively exploited zero-days, CVE-2026-88771 and CVE-2026-88772; and earlier in October it issued emergency updates for CVE-2026-88779, a denial-of-service zero-day later found to allow remote code execution, scoring 8.7.

What Citrix has said about exploitation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged 27 actively exploited Citrix vulnerabilities since November 2021, including seven abused in ransomware attacks. Google researchers said a campaign exploiting CVE-2026-88772 had run since at least early September, likely hitting government, finance, legal, and education organisations across North America and Europe. Administrators should confirm whether their NetScaler instances run in a SAML identity provider or service provider role, then move to the fixed builds Citrix lists. The next step is checking the advisory for their specific version, since some recent builds are affected only in the identity provider configuration.