By David Hollingworth
Publication Date: 2026-10-12 00:53:00
The Australian Signals Directorate’s Australian Cyber Security Centre has updated its recent Citrix alert to include a newly discovered vulnerability in the company’s NetScaler ADC and NetScaler Gateway devices.
“A further critical vulnerability (CVE-2026-107406) impacting Citrix NetScaler ADC and Citrix NetScaler Gateway configured as SAML SP or IdP has been discovered,” the ACSC said in an update published late last week.
“CVE-2026-107406 is a memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service.”
More worryingly, the company’s most recent patches, which addressed a raft of prior vulnerabilities, do not address this latest issue, meaning another round of updates will be necessary to secure Citrix devices.
The versions impacted by the new vulnerability differ between SAML SP or SAML IdP configurations. The versions below have been patched to address CVE-2026-107406:
- Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1-73.46…
