> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Citrix gives NetScaler admins another critical reason to patch - URL: https://f4n6.co.uk/security-feed/citrix-gives-netscaler-admins-another-critical-reason-to-patch/ - Published: 2026-10-09T17:50:26.000Z - Updated: 2026-10-09T17:50:26.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-107406, CVE-2026-88772, CVE-2026-88779 ## 1\. Executive summary Citrix has disclosed CVE-2026-107406, a memory overflow in NetScaler ADC and NetScaler Gateway that can lead to remote code execution or denial of service, rated CVSS 9.5 CRITICAL in the verified reference data and not listed in CISA KEV. It lands on top of two NetScaler memory-buffer flaws that are already in CISA KEV and under active exploitation: CVE-2026-88772 (CVSS 9.5 CRITICAL, KEV added 2026-09-27, EPSS 1%) and CVE-2026-88779 (CVSS 8.7 HIGH, KEV added 2026-10-04, EPSS 1%). All three are SAML-related memory overflows in a product that EMEA banks, insurers and payment firms commonly run in the DMZ as their remote-access and application-delivery tier, so an exploited NetScaler is a perimeter foothold rather than a contained application bug. The KEV remediation due dates for the two exploited flaws have already passed (2026-09-30 and 2026-10-07), which means any unpatched instance is out of compliance now, not at the next change window. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17: ICT-related incident management process | Two of the three flaws in scope (CVE-2026-88772, CVE-2026-88779) are confirmed exploited in the wild against an internet-facing network component, and CVE-2026-107406 is a third RCE-capable flaw in the same component. | Clients running affected NetScaler builds must be able to show their incident-management process covers detection and handling of exploitation of a perimeter appliance, not just internal IT failures. | | DORA Art. 19: reporting of major ICT-related incidents to competent authorities | Exploitation of a NetScaler in the SAML path can yield remote code execution on an authentication gateway, which is the kind of event that can meet the major-incident classification threshold. | If a client confirms exploitation, the reporting clock and the classification decision under Art. 18 are engaged; the KEV due dates already passed for the two exploited CVEs, so the timeline for any incident is retrospective. | | NIS2 Art. 21(2)(d): supply chain security measures | The fix is vendor-supplied and version-dependent, and Citrix states customers must update their own deployments while Citrix handles managed cloud services and Adaptive Authentication. | Clients must be able to evidence that they track vendor advisories for NetScaler and apply the correct build for their configuration, including Secure Private Access Hybrid deployments. | ## 3\. Technical analysis & attack chain CVE-2026-107406 is a memory overflow vulnerability in NetScaler ADC and NetScaler Gateway that may lead to remote code execution or denial of service under specific configuration conditions. Citrix classifies it as CWE-119, improper restriction of operations within the bounds of a memory buffer, which matches the verified reference data for the two exploited flaws in this cluster. The verified reference data records CVE-2026-107406 at CVSS 9.5 CRITICAL and not in CISA KEV; the source reports the same 9.5 figure under CVSS v4.0, so there is no scoring discrepancy to reconcile for this CVE. Exposure depends on build and configuration, and this is the part that decides whether a given appliance is reachable: 1. Older NetScaler builds are vulnerable when the appliance is configured as a SAML service provider (SP) or as a SAML identity provider (IdP). 2. Some more recent builds are affected only in the identity provider configuration. 3. Secure Private Access Hybrid deployments that use NetScaler instances also require patching. 4. Citrix states customers must update their own deployments; Citrix handles the necessary updates for its managed cloud services and Adaptive Authentication. The source does not give the specific affected version numbers or the fixed builds for CVE-2026-107406, and it does not give a pre-authentication or post-authentication condition for the flaw. Treat the exact vulnerable-build list as something to read from Citrix's own advisory before scheduling work. The two exploited flaws in the same component are the reason this disclosure matters more than a routine critical. CVE-2026-88772 is a memory overflow in Datagram Transport Layer Security (DTLS) protocol handling, rooted in the NetScaler code path, and Google researchers said a campaign exploiting it had been underway since at least early September, with organisations in government, finance, legal and education across North America and Europe likely affected. Citrix disclosed that flaw weeks after the campaign began, as part of a release that patched eight vulnerabilities. CVE-2026-88779 was disclosed the following Friday at severity 8.7 and is also confirmed exploited. Both CVE-2026-88772 and CVE-2026-88779 involve memory overflows affecting SAML configurations, and CVE-2026-88779 can allow remote code execution as well as denial of service. The verified reference data records CVE-2026-88779 as CWE-119 and CVE-2026-88772 as CWE-119; the source describes both as memory overflows, which is consistent. The DTLS detail on CVE-2026-88772 is worth acting on separately from SAML. DTLS handling is reachable on UDP where the appliance terminates DTLS, so a SAML-only exposure review will miss an instance that is exploitable through the DTLS path. The source does not state which UDP ports or which NetScaler features enable DTLS termination on a given build, so confirm that from the vendor advisory rather than assuming. Citrix did not say whether CVE-2026-107406 was exploited as a zero-day before disclosure. The flaw was credited to Michael Tucker, Chew Keong Tan and Alex Bernier at JPMorgan Chase's XOR Team, along with Maxim Suhanov. No exploitation of CVE-2026-107406 is recorded in the verified reference data, and no ransomware use is recorded for either KEV entry (both list "Known ransomware campaign use: Unknown"). Do not describe any of the three as ransomware-associated. Attribution caveat: no threat actor is named in the source material for the CVE-2026-88772 campaign, and the verified reference data contains no MITRE ATT&CK profile for any actor in this item. Any attribution of the exploitation activity is unconfirmed. The Google research finding that government, finance, legal and education organisations in North America and Europe were likely affected is single-sourced to that research as reported, and the sector list is described as likely rather than confirmed. ## 4\. Mitigation & containment P1, within 24 hours: - Inventory every NetScaler ADC and NetScaler Gateway instance, including Secure Private Access Hybrid deployments, and record build version and whether SAML is configured. The configuration check from the earlier NetScaler advisory in this cluster is a usable starting filter: look for `add authentication samlAction.*`, `add authentication vserver .*` and `add vpn vserver .*`. An instance with any of those entries and an affected build is the priority. - Patch CVE-2026-88772 and CVE-2026-88779 first. Both are in CISA KEV and both KEV due dates have passed (2026-09-30 and 2026-10-07). If a client cannot patch immediately, the KEV required action is to apply mitigations per vendor instructions or discontinue use of the product where mitigations are unavailable. - Patch CVE-2026-107406 in the same maintenance action rather than a separate window. It is RCE-capable at CVSS 9.5 and shares the SAML memory-overflow mechanism with the two exploited flaws. - For any instance that cannot be patched inside 24 hours, restrict management and SAML endpoints to known source ranges at the network layer and enable full request logging on the SAML and DTLS paths. This is a compensating control, not a fix. P2, within 72 hours: - Confirm the fixed build for each affected configuration against Citrix's advisory. The source does not publish the fixed version numbers for CVE-2026-107406, so do not pin to a version from this advisory. - Hunt for post-exploitation activity on any NetScaler that was internet-facing and unpatched during the exposure window. The source gives no atomic indicators, so the hunt has to be behavioural: unexpected processes on the appliance, configuration changes to SAML actions or vservers, new local accounts, and outbound connections from the appliance that do not match its normal role. - Review authentication logs for SAML assertions that do not correspond to a legitimate identity provider session, and for authentication events originating from the appliance itself. P3, within 7 days: - Add NetScaler build version and SAML configuration state to the asset register so the next advisory in this series can be triaged without a manual sweep. - Where NetScaler is provided under a managed or hybrid arrangement, confirm in writing which party applies the update. Citrix states it handles updates for its managed cloud services and Adaptive Authentication, which leaves the customer responsible for everything else, including Secure Private Access Hybrid. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The sources describe affected configurations and a vulnerability mechanism but publish no hashes, domains, IP addresses, file paths or command lines. Behavioural indicators: | behaviour | where to observe | confidence | | ----------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | | SAML action or vserver configuration present on an affected build | NetScaler configuration (add authentication samlAction.\*, add authentication vserver .\*, add vpn vserver .\*) | High, configuration check published by Rapid7 for the related CVE-2026-19490 advisory | | Exploitation of the DTLS handling path | NetScaler DTLS termination, UDP | Medium, mechanism stated for CVE-2026-88772; specific ports not given in source | | Post-exploitation activity on an internet-facing appliance | NetScaler process list, configuration store, outbound network connections | Low, no source detail on observed post-exploitation behaviour | ## 6\. Detection The sources contain no file hashes, mutexes, filenames, registry keys or command-line artefacts belonging to the threat itself. The only concrete strings are NetScaler configuration directives, which are legitimate administrative configuration and would generate false positives if used as a malware signature. No YARA rule is emitted for that reason. A Sigma rule is supportable for the configuration condition that determines exploitability, which is a log and configuration indicator rather than a malware artefact. ```yaml title: NetScaler SAML Configuration Present on Potentially Vulnerable Build id: 8f2c1a44-7d3e-4b91-9c05-6a1e2f7b0d38 status: experimental description: Detects NetScaler configurations that include a SAML action or an authentication or VPN vserver, the configuration condition under which CVE-2026-107406, CVE-2026-88772 and CVE-2026-88779 are reachable. Presence of these entries does not indicate compromise; it indicates the appliance must be checked against the affected build list. author: Adverse Trace date: 2026-10-09 references: - https://www.theregister.com/security/2026/10/09/citrix-gives-netscaler-admins-another-critical-reason-to-patch/5302212 - https://www.rapid7.com/blog/post/etr-cve-2026-19490-critical-vulnerability-affecting-citrix-netscaler-adc-and-netscaler-gateway logsource: product: citrix service: netscaler detection: selection_saml: message|re: 'add authentication samlAction.*' selection_vserver: message|re: 'add (authentication|vpn) vserver .*' condition: selection_saml or selection_vserver falsepositives: - Any NetScaler legitimately configured for SAML single sign-on or remote access. This rule is an exposure indicator, not a compromise indicator. level: informational ``` ## CVE assessment 3 referenced CVEs — **2 actively exploited (CISA KEV)**, 2 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | ---------------------------------------------------------------------------------- | ------------ | ---------------- | ---- | ------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-88772](https://nvd.nist.gov/vuln/detail/CVE-2026-88772?ref=f4n6.co.uk) | 9.5 Critical | ⚠ KEV 2026-09-27 | 1% | Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.… | | [CVE-2026-88779](https://nvd.nist.gov/vuln/detail/CVE-2026-88779?ref=f4n6.co.uk) | 8.7 High | ⚠ KEV 2026-10-04 | 1% | Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.… | | [CVE-2026-107406](https://nvd.nist.gov/vuln/detail/CVE-2026-107406?ref=f4n6.co.uk) | 9.5 Critical | — | — | Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC. NetScaler… | ## 7\. Sources - The Register, "Citrix gives NetScaler admins another critical reason to patch", https://www.theregister.com/security/2026/10/09/citrix-gives-netscaler-admins-another-critical-reason-to-patch/5302212, 2026-10-09 - The Hacker News, "Citrix Patches Critical NetScaler Flaw That Could Enable RCE in SAML Deployments", https://thehackernews.com/2026/10/citrix-patches-critical-netscaler-flaw.html - The Hacker News, "Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution", https://thehackernews.com/2026/09/citrix-netscaler-cve-2026-88772-exploit.html - CISA Known Exploited Vulnerabilities, CVE-2026-88772, https://nvd.nist.gov/vuln/detail/CVE-2026-88772 - CISA Known Exploited Vulnerabilities, CVE-2026-88779, https://nvd.nist.gov/vuln/detail/CVE-2026-88779 - Rapid7, "CVE-2026-19490: Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway", https://www.rapid7.com/blog/post/etr-cve-2026-19490-critical-vulnerability-affecting-citrix-netscaler-adc-and-netscaler-gateway - Help Net Security, "Citrix urges customers to fix critical NetScaler authentication bypass (CVE-2026-19490)", https://www.helpnetsecurity.com/2026/08/21/citrix-netscaler-gateway-cve-2026-19490/ ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-107406 at CVSS 9.5 CRITICAL, not in CISA KEV, with no confirmed exploitation; CVE-2026-88772 at CVSS 9.5 CRITICAL and CVE-2026-88779 at CVSS 8.7 HIGH, both in CISA KEV and both past their remediation due dates. The client impact is concentrated in the perimeter: a NetScaler in the SAML or DTLS path that is unpatched is an internet-reachable RCE target, and the two exploited flaws show the exploitation window opened before Citrix disclosed them. The Google research on the CVE-2026-88772 campaign and the affected sectors is single-sourced as reported here; verify before using it in any regulatory notification. No actor attribution is supportable from this material. We will track Citrix's advisory for the affected and fixed build list for CVE-2026-107406, which the source does not publish, and we will issue a follow-up if exploitation of CVE-2026-107406 is confirmed or if it is added to CISA KEV. Clients who cannot confirm their NetScaler build and SAML configuration state within 24 hours should treat those instances as exposed and apply the P1 network restrictions. --- [Read the original source →](https://www.theregister.com/security/2026/10/09/citrix-gives-netscaler-admins-another-critical-reason-to-patch/5302212?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*