> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Citrix Urges Immediate Patching of Critical NetScaler Vulnerability - URL: https://f4n6.co.uk/security-feed/citrix-urges-immediate-patching-of-critical-netscaler-vulnerability/ - Published: 2026-10-09T08:10:19.000Z - Updated: 2026-10-09T08:10:19.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-107406 ## 1\. Executive summary Citrix has disclosed a critical memory overflow in NetScaler ADC and NetScaler Gateway, tracked as CVE-2026-107406, with a CVSS score of 9.5, that can lead to remote code execution or denial of service. The flaw affects appliances configured as a SAML service provider or SAML identity provider, and Secure Private Access Hybrid deployments that use NetScaler. Citrix states it is not aware of any unmitigated exploits as of the bulletin, and the CVE is not listed in CISA KEV. The risk to EMEA financial services is concentrated in internet-facing SAML endpoints: these appliances sit on the authentication path for remote access and single sign-on, so a working RCE against them yields a position from which session tokens and federated identities can be reached. This disclosure lands in the middle of an active NetScaler exploitation cycle, which raises the operational priority even though this specific CVE is not yet confirmed exploited. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | --------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17: ICT-related incident management process | NetScaler ADC and Gateway are authentication-path infrastructure; a compromise of a SAML SP or IdP is an ICT-related incident that must be handled under the firm's incident management process, not as a routine patch. | Confirm the incident management process covers authentication infrastructure and that detection, triage and escalation paths for these appliances are documented and tested. | | DORA Art. 24: digital operational resilience testing — general requirements | The affected component is internet-facing and reachable by unauthenticated attackers, which makes it a candidate for inclusion in the firm's resilience testing scope. | Add NetScaler SAML endpoints to the testing scope and validate that existing controls detect exploitation attempts against them. | | NIS2 Art. 21(2)(d): supply chain security measures | The fix is delivered by a third-party vendor (Cloud Software Group / Citrix) and the exposure depends on the deployed build, so the supplier relationship and the update path are in scope. | Verify that the supplier notification and patch-delivery path for NetScaler is documented, and that the firm can confirm which builds are deployed across its estate. | No other article in the reference is directly engaged by this item. The CVE is not in CISA KEV, so no US federal remediation due date applies; the CISA KEV due date of 2026-09-30 in the related material belongs to CVE-2026-88772, a different vulnerability. ## 3\. Technical analysis & attack chain CVE-2026-107406 is a memory overflow in NetScaler ADC and NetScaler Gateway. Citrix describes the impact as remote code execution or denial of service. The verified reference data records CVSS 9.5 (critical) and confirms the CVE is not in CISA KEV. The source material does not describe the exploitation mechanism, the specific memory operation that overflows, or whether authentication is required to reach the vulnerable code path. Those details are not available and should not be assumed. Confirmed facts about the affected scope: 1. The flaw affects NetScaler ADC and NetScaler Gateway appliances configured as a SAML service provider (SP) or SAML identity provider (IdP), under specific configuration conditions that Citrix has not detailed in the material available. 2. Secure Private Access Hybrid deployments that use NetScaler are also affected and require the same update. 3. Patches are included in NetScaler ADC and Gateway versions 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS, and 13.1.37.283 (of 13.1-FIPS and 13.1-NDcPP). 4. Citrix states that as of the publication of the bulletin it is not aware of any unmitigated exploits of this vulnerability. The attack chain for this CVE cannot be written from the available material. What can be stated is the position the appliance occupies: a NetScaler configured as a SAML SP or IdP terminates or brokers authentication for downstream applications. An attacker who achieves code execution on that appliance is positioned on the authentication path rather than at its edge. The source does not describe post-exploitation behaviour for CVE-2026-107406, so no persistence, command-and-control, lateral movement or exfiltration detail is asserted here. Context from the surrounding NetScaler exploitation cycle is relevant to prioritisation but must not be conflated with this CVE. Two earlier NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, were exploited in zero-day attacks to plant webshells on compromised devices, according to Help Net Security. CVE-2026-88772 is listed in CISA KEV with a due date of 2026-09-30 and a known ransomware campaign use status of "Unknown". Those attacks were reported against government, financial services, education, legal and professional services organisations. A separate zero-day, CVE-2026-88779, led to denial of service. None of these are CVE-2026-107406, and none of the exploitation reporting establishes that CVE-2026-107406 has been exploited. Confidence caveats. The claim that CVE-2026-88771 and CVE-2026-88772 were exploited to plant webshells rests on a single vendor report (Help Net Security) and should be treated as single-sourced; verify before using it to drive enforcement decisions. The related reporting on the earlier zero-days also cites warnings relayed through the Dutch national cyber security centre and European government sources, which is second-hand and not independently corroborated in the material provided. No named threat actor is associated with any of these CVEs in the verified reference data, and no MITRE ATT&CK profile is available for any actor in this item. Any attribution of these attacks to a specific group is unconfirmed and should not be repeated as fact. ## 4\. Mitigation & containment P1 (within 24 hours) - Identify every NetScaler ADC and NetScaler Gateway instance configured as a SAML SP or SAML IdP, plus any Secure Private Access Hybrid deployment using NetScaler. These are the affected configurations; instances not in these roles are not described as affected by this CVE. - For each affected instance, record the running build and compare it against the fixed versions: 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS, and 13.1.37.283 (of 13.1-FIPS and 13.1-NDcPP). Any build below these is exposed. - Where an affected instance cannot be patched inside the window, restrict reachability to its SAML endpoints at the network layer. Limit source addresses to known identity providers and known client ranges, and remove any management interface exposure to the internet. - Review NetScaler and upstream web logs for the period since the bulletin for unexpected process activity, new files under the appliance web directories, or authentication events that do not match normal SAML flows. The source does not provide specific log signatures for this CVE, so this is a baseline review rather than a signature match. P2 (within 72 hours) - Upgrade affected instances to the fixed builds. Citrix's guidance is to upgrade impacted appliances to the recommended builds as soon as possible; the vendor fix is the version set listed above. - For Secure Private Access Hybrid deployments, confirm the NetScaler component has been updated and not only the Secure Private Access application tier. - Rotate credentials and secrets that terminate on or pass through the affected appliance, including SAML signing certificates and any service accounts used by the appliance, if there is any indication the instance was reachable and unpatched. P3 (within 7 days) - Confirm the estate inventory is complete: appliances that were stood up for a project, a lab, or a migration and never decommissioned are the common gap in NetScaler exposures. - Verify that the patching path for NetScaler is covered by the firm's third-party risk process, including who receives Citrix security bulletins and how the build is confirmed after upgrade. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The sources describe affected configurations and fixed versions, not atomic indicators. No file hashes, domains, IP addresses, URLs, file paths, registry keys or mutexes are present in the material provided. The webshell activity reported for CVE-2026-88771 and CVE-2026-88772 is described only at the level of "webshells planted on compromised devices", with no filenames, paths or hashes given, and it relates to different CVEs. Behavioural indicators | behaviour | where to observe | confidence | | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- | | Unexpected file creation in NetScaler web-accessible directories, consistent with webshell placement reported for the earlier NetScaler zero-days | NetScaler appliance filesystem and integrity monitoring | Low for CVE-2026-107406; the webshell behaviour is reported for CVE-2026-88771 and CVE-2026-88772, single-sourced | | SAML authentication events that do not correspond to a known identity provider or expected assertion pattern | NetScaler authentication logs and downstream application logs | Low; no specific pattern is described in the source | | Reachability of NetScaler SAML SP or IdP endpoints from unexpected source addresses | Perimeter firewall and load balancer logs | Medium; derived from the affected configuration, not from observed exploitation | ## 6\. Detection Insufficient indicators to author detection rules. The sources contain no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names or paths, registry keys, ransom-note text or hard-coded values for CVE-2026-107406\. The only artefacts named are CVE identifiers, product names and version numbers, none of which are artefacts of the threat itself. A rule built from those would detect reporting about the vulnerability, not exploitation of it. No YARA or Sigma rule is emitted. ## CVE assessment 1 referenced CVE — 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | ---------------------------------------------------------------------------------- | ------------ | --------- | ---- | ------------------------------------------------------------------------------------------------------------------------------ | | [CVE-2026-107406](https://nvd.nist.gov/vuln/detail/CVE-2026-107406?ref=f4n6.co.uk) | 9.5 Critical | — | — | Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC. NetScaler… | ## 7\. Sources - SecurityWeek, "Citrix Urges Immediate Patching of Critical NetScaler Vulnerability", https://www.securityweek.com/citrix-urges-immediate-patching-of-critical-netscaler-vulnerability/, 2026-10-09 - Cybersecurity Dive, "Citrix urges immediate upgrades of NetScaler amid widespread exploitation attempts", https://www.cybersecuritydive.com/news/citrix-upgrades-netscaler-exploitation/831502/ - SecurityWeek, "Recent Citrix NetScaler Vulnerability Exploited in the Wild", https://www.securityweek.com/recent-citrix-netscaler-vulnerability-exploited-in-the-wild/ - Help Net Security, "Citrix urges customers to fix critical NetScaler authentication bypass (CVE-2026-19490)", https://www.helpnetsecurity.com/2026/08/21/citrix-netscaler-gateway-cve-2026-19490/, 2026-08-21 - CISA Known Exploited Vulnerabilities, CVE-2026-88772, Citrix NetScaler, https://nvd.nist.gov/vuln/detail/CVE-2026-88772 - The Hacker News, "Citrix Patches Six NetScaler Flaws Allowing File Read and Denial-of-Service", https://thehackernews.com/2026/07/citrix-patches-six-netscaler-flaws.html - Help Net Security, "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)", https://www.helpnetsecurity.com/2026/09/28/citrix-netscaler-rce-zero-days-exploited-for-weeks-cve-2026-88771-cve-2026-88772/, 2026-09-28 ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-107406 as critical at CVSS 9.5 per the verified reference data, with no CISA KEV listing and no confirmed exploitation as of the Citrix bulletin. The absence of KEV listing and of observed exploitation lowers the urgency relative to the earlier NetScaler zero-days, but it does not lower the exposure: the affected configurations are authentication-path appliances, and the fix is a version upgrade that many estates will need to schedule. The client impact is concentrated in firms running NetScaler as a SAML SP or IdP or in a Secure Private Access Hybrid deployment, particularly where those instances are internet-facing and where the build has not moved since the earlier NetScaler patching rounds. We will track whether CVE-2026-107406 is added to CISA KEV or reported exploited, and we will update this advisory if either occurs. Clients who cannot confirm their NetScaler build and configuration role within 24 hours should treat the instance as exposed and restrict reachability to its SAML endpoints until the build is verified. --- [Read the original source →](https://www.securityweek.com/citrix-urges-immediate-patching-of-critical-netscaler-vulnerability/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*