Four Citrix NetScaler Flaws in Two Weeks, Three Already Exploited
A critical memory-overflow bug joins two actively exploited remote-code-execution flaws and a denial-of-service zero-day hitting the same Citrix product line inside a fortnight.
Key points
- CVE-2026-107406, rated 9.5 out of 10 in severity, lets attackers run arbitrary code or knock a Citrix NetScaler appliance offline, with no known exploitation as of the Citrix bulletin's publication date.
- Two earlier NetScaler flaws, CVE-2026-88771 and CVE-2026-88772, were already being used in real attacks against government, financial services, education, legal, and healthcare organisations before patches arrived.
- CVE-2026-88779, a third zero-day, was added to the US government's watch list of actively exploited bugs on 2026-10-04, with federal agencies ordered to patch by 2026-10-07.
- All four vulnerabilities affect Citrix NetScaler ADC and NetScaler Gateway, network appliances organisations use to control remote access to their internal systems.
Citrix has issued four security warnings about the same product line in under two weeks, and three of those bugs were already weaponised before fixes existed.
NetScaler ADC (Application Delivery Controller) and NetScaler Gateway are networking appliances, physical or virtual, that sit between the public internet and a company's private network, managing and securing remote access. When the gatekeeper has a critical flaw, everyone behind it is exposed.
What does the newest flaw actually do?
The latest bug, CVE-2026-107406, scores 9.5 on the ten-point CVSS scale. It's a memory overflow: an attacker sends the appliance more data than it can handle, causing a crash (denial-of-service, cutting off legitimate users) or, worse, remote execution of malicious code on the device itself.
The flaw only triggers on appliances configured as a SAML SP or SAML IdP. SAML (Security Assertion Markup Language) is the standard that lets employees sign into multiple work applications with a single login. Many large organisations depend on it, so the pool of vulnerable devices is real and wide.
Citrix says it isn't aware of any active exploitation of this specific bug as of the bulletin's publication date. That's the one piece of good news here.
Which versions are affected, and what should admins install?
| CVE | CVSS | Status | Fix version (ADC/Gateway) |
|---|---|---|---|
| CVE-2026-107406 | 9.5 Critical | Not yet exploited | 14.1-73.46 / 13.1-64.29 |
| CVE-2026-88771 | 9.5 Critical | Actively exploited | 14.1-73.37 / 13.1-64.23 |
| CVE-2026-88772 | Not published | Actively exploited | 14.1-73.37 / 13.1-64.23 |
| CVE-2026-88779 | 8.7 High | Actively exploited | 14.1-73.41 / 13.1-64.28 |
For FIPS-certified builds used in regulated industries, the patched versions are 14.1-73.46 FIPS and 13.1.37.283.
CVE-2026-88771 lets an attacker with no credentials at all run commands on a vulnerable device. The CISA Known Exploited Vulnerabilities catalogue confirmed active exploitation, with US federal agencies required to patch by 2026-09-30. CVE-2026-88772 carried the same deadline and the same consequences. CVE-2026-88779 followed, added to the CISA list on 2026-10-04 with a federal deadline of 2026-10-07. We first covered that zero-day on 5 October, in "Citrix NetScaler Zero-Day Is Knocking Login Systems Offline", when federal agencies were already racing a three-day clock.
All three exploited bugs were used against government agencies, banks, universities, law firms, and other professional services organisations, first reported by SecurityWeek.
Should you worry?
Three confirmed in-the-wild exploits in a single fortnight, with a fourth critical flaw queued behind them, isn't coincidence. Someone has found that this product line pays. The honest read: NetScaler is under sustained, targeted attack, and patching speed is now a competitive advantage between defenders and whoever is working these bugs.
Any organisation running NetScaler ADC or NetScaler Gateway should treat upgrading as urgent this week. Check whether your appliances are configured as SAML SP or SAML IdP: if they are, CVE-2026-107406 sits on top of the three already-exploited flaws as your immediate priority. Citrix also notes that Secure Private Access Hybrid deployments using NetScaler need the same updates. If a third-party provider manages your network kit, call them and ask specifically about NetScaler patch status.
