By Tamilselvan
Publication Date: 2026-10-09 06:44:00
Citrix has disclosed a critical memory overflow vulnerability in NetScaler ADC and NetScaler Gateway that could allow remote code execution or denial-of-service attacks under specific configuration conditions.
Tracked as CVE-2026-107406, the vulnerability has a CVSS v4.0 base score of 9.5, prompting an urgent recommendation that affected customers upgrade their appliances.
According to the supplied NetScaler, exposure depends on both the installed software build and whether the appliance operates as a Security Assertion Markup Language (SAML) service provider or identity provider.
Critical Citrix NetScaler Vulnerability
Citrix stated that, when it published the bulletin, it was not aware of any unmitigated exploits targeting the vulnerability. The advisory separates affected deployments into two categories. For certain newer builds, the vulnerability applies only when NetScaler is configured as a SAML identity provider, or IdP.
This category includes NetScaler…
