Citrix gives NetScaler admins another critical reason to patch

If you use Citrix NetScaler ADC or Gateway, you must apply security patches to prevent potential remote code execution or denial of service attacks.

Citrix has released a critical security update for its NetScaler ADC and NetScaler Gateway products to address CVE-2026-107406, a vulnerability with a CVSS score of 9.5. The flaw can lead to remote code execution or denial of service. Vulnerability depends on configuration; older builds are affected when used as a SAML service provider or identity provider, while some newer builds are only affected in the identity provider role. Secure Private Access Hybrid deployments also require patching. Citrix has not confirmed if this vulnerability was exploited as a zero-day prior to its disclosure. The discovery is credited to researchers from JPMorgan Chase and Maxim Suhanov. Separately, Google researchers have identified a campaign exploiting a different Citrix vulnerability, CVE-2026-88772, affecting organizations across North America and Europe since early September.

This new critical vulnerability, following recent disclosures of actively exploited flaws, underscores a persistent security challenge for NetScaler users and highlights potential systemic weaknesses. The repeated emergence of high-severity flaws, particularly those impacting SAML configurations, suggests that ongoing threat actors are actively targeting these specific components. Organizations relying on NetScaler for secure access and identity management face a continuous need for vigilance and rapid patching to mitigate emerging risks.

The disclosure pattern suggests a cat-and-mouse game where new vulnerabilities are discovered and exploited before patches are widely deployed, forcing a reactive security posture. Customers must prioritize updating their NetScaler instances, as demonstrated by the ongoing exploitation of a prior flaw, to avoid becoming victims of sophisticated attacks. The industry should watch how Citrix addresses these recurring memory overflow issues and whether future updates provide more robust protection against such exploits.