The third NetScaler patch in eleven days

Citrix on Thursday published a security bulletin for CVE-2026-107406, a memory-overflow flaw in NetScaler ADC and NetScaler Gateway that can lead to remote code execution or denial of service. The bulletin rates it 9.5 under version 4 of the CVSS scoring system and dates its initial publication to 8 October. It is the third NetScaler bulletin since 27 September, by our count covering ten CVEs in 11 days. Unlike the two before it, Citrix has not reported this one as exploited.

As with last week's flaw, the precondition is SAML, the single sign-on standard. An appliance is exposed only if it is configured as a SAML service provider or identity provider, which the bulletin says administrators can check by looking for "add authentication samlAction" or "add authentication samlIdPProfile" in the configuration. The bulletin classes the bug as CWE-119, improper restriction of operations within a memory buffer. Its scoring vector describes a network attack needing no privileges and no user interaction, but with high attack complexity.

The version ranges are the detail that matters to anyone who patched this month. Builds before 14.1-73.37 and 13.1-64.23 are affected whether the appliance acts as a service provider or an identity provider. Builds from 14.1-73.37 to 14.1-73.41, and from 13.1-64.23 to 13.1-64.28, are affected only as an identity provider. Those upper bounds, 14.1-73.41 and 13.1-64.28, are the fixed releases in Citrix's bulletin for CVE-2026-88779, the exploited SAML flaw it patched on 4 October. By our reading of the two bulletins, an appliance brought up to date for that flaw and configured as an identity provider still needs this update.

The fixed releases are 14.1-73.46 and 13.1-64.29 and later, with matching FIPS and NDcPP builds, and Cloud Software Group, Citrix's parent, "strongly urges" affected customers to install them "as soon as possible". The bulletin offers no mitigation short of upgrading. It covers customer-managed appliances only; Citrix says it updates its own cloud services and Adaptive Authentication. Secure Private Access Hybrid deployments that use NetScaler instances are also affected, it said.

On exploitation, Citrix's bulletin is silent. The Register reported that the company did not say whether the flaw had been used as a zero-day before disclosure. Citrix told customers that "as of the publication of the bulletin, Citrix is not aware of any unmitigated exploits of this vulnerability", BleepingComputer reported, quoting the company. The bulletin credits Joshua Foote, Michael Tucker and Eugene Lim of JPMorgan Chase's XOR Team; The Register and The Hacker News named a different list, of Tucker, Chew Keong Tan and Alex Bernier of the same team, with Maxim Suhanov.

The background explains the urgency. On Sunday 27 September Citrix published a bulletin covering eight CVEs, of which CVE-2026-88771 and CVE-2026-88772, both rated 9.5, were already under attack, The Register reported. Google's researchers said the campaign exploiting CVE-2026-88772 had run "since at least early September", according to The Register. A week later came CVE-2026-88779, rated 8.7, which Citrix describes as a denial-of-service flaw and which CISA added to its catalogue of known exploited vulnerabilities on Sunday 4 October.

Not every specialist expects the newest flaw to follow the same path. Stephen Fewer, senior security researcher at Rapid7, told Cybersecurity Dive that customers should patch "on an urgent basis", but that "there is no successful exploitation publicly reported at this time, and given that CVE-2026-107406 is a memory corruption vulnerability, broad successful exploitation across unpatched appliances is less likely than that of CVE-2026-88771." The same outlet reported that CISA on Friday urged organisations to patch their Citrix systems.

For administrators the cost is repetition. A NetScaler gateway is often the front door for remote staff, and each upgrade means a maintenance window. During the late-September attacks, Mandiant's Charles Carmakal advised customers to examine appliances for signs of compromise, such as web shells, before upgrading, since a patch closes the hole but does not evict an intruder. That advice was given for the exploited flaws, not this one. Citrix's 9.5 score and the overlap in version ranges are, for now, the case for moving quickly.

Komposite reported last week that appliances patched for September's flaws began crashing under CVE-2026-88779, and in September on CISA's three-day deadline for the first two. As of Monday we had found no public report of CVE-2026-107406 being exploited.