NetScaler CVE-2026-107406 Patch Marks Third Critical Fix in Weeks

A Third Emergency in Three Weeks

Citrix shipped another critical patch for NetScaler ADC and NetScaler Gateway on October 8, 2026. It is the third straight week the company has warned customers who run their own instances. The new flaw, CVE-2026-107406, is a memory overflow. It carries a CVSS v4.0 score of 9.5 and can lead to remote code execution or denial of service on appliances with certain SAML settings.1211 Citrix published the details in security bulletin CTX697191. The company said it was "not aware of any unmitigated exploits" when the bulletin went out.118

That reassurance is narrower than it sounds. Taken alone, this would be a routine high-severity bug report. It arrives, though, after two weeks in which NetScaler customers dealt with actively exploited zero-days, emergency weekend releases, and fixes that themselves turned out to need fixing. Administrators should read CVE-2026-107406 as part of that larger story.

What the New Bulletin Says

Citrix classifies the bug as CWE-119, meaning the software fails to properly restrict operations within a memory buffer.1119 The scoring describes an attack carried out over the network that needs no privileges and no user interaction. It is rated high in attack complexity, and Citrix released no exploit details.11

Whether an appliance is exposed depends on its SAML role and its build. Builds 14.1-73.37 through 14.1-73.41 and 13.1-64.23 through 13.1-64.28 are vulnerable only when the appliance acts as a SAML identity provider (IdP).1114 Older builds are exposed whether the appliance is configured as an identity provider or a service provider (SP).1419 Secure Private Access Hybrid deployments built on NetScaler also need updating. Citrix-managed cloud services and Adaptive Authentication are patched by the vendor.1419

The fixed builds are 14.1-73.46 or later, 13.1-64.29 or later, 14.1-73.46 FIPS, and 13.1-37.283 for the 13.1-FIPS and NDcPP branches.1113 Admins can check an appliance's SAML role in its configuration. An add authentication samlAction entry means it is a service provider, and an add authentication samlIdPProfile entry means it is an identity provider.13

Citrix credited Michael Tucker, Chew Keong Tan and Alex Bernier of the JPMorgan Chase XOR Team, along with Maxim Suhanov, with finding the flaw.1419 A bank's in-house security team finding a critical bug in an edge appliance suggests that big customers are now auditing this code themselves rather than waiting for the vendor.

The Patches Keep Patching the Patches

The version ranges reveal the real problem. The builds now listed as vulnerable when used as a SAML identity provider, 14.1-73.37 through 73.41, are the same builds Citrix urged customers to install over the previous two weeks. Here is how this year's 14.1 releases have played out:

• August 19: Citrix fixed CVE-2026-19490, an authentication bypass rated 9.3, along with a memory overflow, in 14.1-73.32 and 13.1-63.21.210
• September 27: Citrix disclosed eight more flaws in bulletin CTX697096 and moved the fixed baseline to 14.1-73.37 and 13.1-64.23. Appliances already patched for the August bug were still exposed.39
• October 3–4: CVE-2026-88779 forced another upgrade, to 14.1-73.41 and 13.1-64.28. Citrix told customers already patched under the September bulletin to upgrade again if their appliances met the SAML preconditions.204
• October 8: CVE-2026-107406 moves the baseline once more, to 14.1-73.46 and 13.1-64.29.11

That makes four upgrade cycles in about seven weeks for the same product line. Cybersecurity News warns that an appliance patched for an earlier issue may still need this new upgrade.11 The bigger worry, as this analysis reads it, is fatigue. Every emergency upgrade costs a maintenance window, a risk to availability, and some of a team's confidence. Citrix is now asking customers to spend all three at a weekly pace.

The Zero-Days That Set the Stage

The trouble became public on September 26. Security firm watchTowr warned that NetScaler remote code execution flaws with no available patch were being exploited, based on forensic investigations.3 Citrix published fixes the next day, a Sunday. CVE-2026-88771 is an input validation flaw that lets an unauthenticated attacker run commands on default configurations. CVE-2026-88772 is a memory overflow reachable when DTLS is enabled, which is the default on VPN virtual servers.917 watchTowr CEO Benjamin Harris said "Monday will be too late" to patch.17 CISA added both flaws to its Known Exploited Vulnerabilities (KEV) catalog the same day, citing reports of exploitation worldwide.1

Coverage of how long the attacks ran before disclosure points one way. Google researchers said a campaign exploiting CVE-2026-88772 had been running since at least early September. They said organizations in government, finance, legal and education across North America and Europe were likely affected.19 Palo Alto Networks' Unit 42 said attackers used the two flaws to plant web shells for initial access and persistence. It also logged probing requests that kept arriving until hours before Citrix's bulletin.5 That gap of weeks between first exploitation and a public fix is what turns a patch story into a possible breach story. Organizations that were exposed during that period should assume they were compromised until they can show otherwise. watchTowr and CISA both advise preserving forensic evidence before upgrading, because an upgrade can wipe it.3

Where the Accounts Diverge: CVE-2026-88779

The sources disagree most over CVE-2026-88779, which Citrix disclosed in early October and rated 8.7. Citrix's official description is denial of service. The company said it saw targeted attacks that could leave services unavailable, and that it found no impact on the integrity of customer data.204

People outside Citrix described something more serious. One administrator found crafted login usernames containing shell commands that downloaded and ran a payload, just before authentication service crashes. That administrator noted the logs did not confirm the commands actually ran.20 Researcher Kevin Beaumont reported that one of his patched honeypots was running a downloaded malware payload. He compared the case to CVE-2025-6543, an earlier NetScaler bug first labeled denial of service that was later used for code execution.20 eSentire also cited unconfirmed reports that the flaw had been escalated to remote code execution.18

CISA's updated alert offers a middle reading that may matter most. On unpatched appliances, attackers might use CVE-2026-88779 to force a reboot, which speeds up execution of code previously planted through CVE-2026-88771.1 watchTowr researchers told The Register they suspected the same: deliberate crashes used to make the other exploit work faster.7 In this reading, labeling the bug as denial of service is technically accurate but misleading in practice, because the crash is part of the intrusion chain. Defenders should plan around CISA's version, not the vendor's narrower description.

The wording on the new flaw varies too. Security Affairs reports that Citrix is not aware of attacks in the wild.13 Citrix's own statement is narrower: it knows of no unmitigated exploits.8 Cybersecurity News warns that this wording should not be read as proof that every deployment is safe.11 The Register adds that Citrix did not say whether the bug was exploited as a zero-day before disclosure.19 Given the pattern of the past month, the cautious reading is the right one.

Why the Exposure Is Large

The number of potential targets is large. Shadowserver has counted more than 21,000 internet-facing IP addresses with NetScaler fingerprints: roughly 20,000 ADC appliances and about 1,500 Gateway instances.16 CISA has now folded CVE-2026-107406 into its running NetScaler alert. The alert covers ten vulnerabilities and urges prompt patching across the full set, plus a review of Citrix's guidance for suspected compromises.1 CISA gave federal civilian agencies until October 7 to fix CVE-2026-88779, three days after adding it to KEV.18

The Takeaway

We see two lessons. The first is practical. Every NetScaler that uses SAML in either role needs to be on 14.1-73.46, 13.1-64.29, or the matching FIPS or NDcPP build, whatever was installed last week. Any appliance that was reachable from the internet in September should also be checked for web shells and persistence.115

The second lesson concerns the product. Over these four releases, the SAML authentication path shows up again and again: the August bypass, CVE-2026-88779, and now CVE-2026-107406.2411 Network World says NetScaler "seems to have a memory problem," and the string of CWE-119 entries supports that.12 Until Citrix shows that it has looked at that code as a whole rather than bug by bug, customers should treat NetScaler's authentication features as a high-risk part of their network. That means monitoring them closely, keeping them only where needed, and being ready for next week's bulletin.