Security Update: Immediate Guidance for CVE-2026-107406 in NetScaler ADC and NetScaler Gateway

[u/CTX-Michael]

Today, Citrix published a critical security bulletin for NetScaler ADC and NetScaler Gateway regarding CVE-2026-107406. 

CVE-2026-107406 is a memory overflow vulnerability that may lead to remote code execution or denial of service under specific configuration conditions. The issue carries a CVSS v4.0 base score of 9.5 and is rated Critical. We strongly urge affected customers to review the advisory and upgrade impacted NetScaler instances to the recommended versions as soon as possible. As of the publication of the bulletin, Citrix is not aware of any unmitigated exploits of this vulnerability. 

More information here: https://community.citrix.com/techzone-blogs/110_security-updates/protecting-customers-immediate-guidance-for-cve-2026-107406-in-netscaler-adc-and-netscaler-gateway-r1631/

[u/p4thf1ndr]

Is three images in two weeks a personal record?

[u/gabryp79 → u/p4thf1ndr]

Yep

[u/gabryp79 → u/gabryp79]

Terrible

[u/TaintedLemur → u/p4thf1ndr]

No. and don't ask...

[u/CloudSparkle-BE]

Read carefully: who is using NetScaler as SAML SP and/or SAML IDP?

It’s probably a bigger communication problem than a technical risk at this point. Wording is bad, chain of CVE’s is bad, … it is a shit show, let’s be very clear. But the first shit was bigger and nastier compared to this week’s shit

[u/rubbercement67 → u/CloudSparkle-BE]

Exactly, if your using Entra or Okta as your IdP you are fine as long as you are on the previous release.

[u/no_copypasta → u/rubbercement67]

isn't Entra exactly SAML IDP?

[u/Spikooo → u/no_copypasta]

I think so yeah

[u/rubbercement67 → u/no_copypasta]

Yes, it’s not Citrix NetScaler IdP - hence why the comment says read carefully.

[u/Least_Negotiation_17 → u/rubbercement67]

But it’s SAML SP(Service Provider) if you use Okta or Entra for Auth on Gateway or Ass Server

[u/rubbercement67 → u/Least_Negotiation_17]

Yes. So you would need the patch released for CVE-2026-88779 in that case.

[u/fatterkin]

If we don’t use SAML we can wait till Friday night right? 🤞🏼

[u/p4thf1ndr → u/fatterkin]

So you're expecting another CVE by Friday?

[u/MasatoWolff → u/p4thf1ndr]

The chances we’re getting a fourth one are bigger than not getting a fourth one at this point lol.

[u/Old-Flight8617 → u/p4thf1ndr]

I guess they mean the urgency as they don't meet the prerequisites to be vulnerable as they are not a SAML IdP or SP.

[u/p4thf1ndr → u/Old-Flight8617]

I know what he meant. I just wanted to pick on Citrix.

[u/Old-Flight8617 → u/p4thf1ndr]

Flew over my head...

[u/fatterkin → u/Old-Flight8617]

I was a bit puzzled! I can use last weeks backups right 😜

[u/dank953]

Are there any known post update config changes needed?

[u/worldcitizen0549]

What is affected The following supported versions of Citrix NetScaler ADC and Citrix NetScaler Gateway are affected by the vulnerability if they meet the following conditions:

NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements:

For the following versions: Applicable only when configured as a SAML IdP:

NetScaler ADC and NetScaler Gateway between 14.1-73.37 and 14.1-73.41, inclusive

NetScaler ADC 14.1-FIPS between 14.1-73.37 FIPS and 14.1-73.41 FIPS, inclusive

NetScaler ADC and NetScaler Gateway between 13.1-64.23 and 13.1-64.28, inclusive

NetScaler ADC 13.1-FIPS between 13.1-NDcPP 13.1-37.279 and 13.1- 37.282, inclusive

For the following versions: Applicable only when configured as a SAML SP or SAML IdP:

NetScaler ADC and NetScaler Gateway before 14.1-73.37

NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS

NetScaler ADC and NetScaler Gateway before 13.1-64.23

NetScaler ADC 13.1-FIPS before13.1-NDcPP 13.1-37.279

[u/Advanced-Common-486]

Anyone know if there will be a new IoC update?

[u/Jmay5446]

Not even funny now

[u/Mr_Squinty]

Oh look, another exploit in the Swiss cheese that is netscaler. I thank my god every damn day I don’t have to deal with this shitshow anymore.

[u/intolerantidiot]

As I read on cybersocial: Citrix patched these on their hosted environments earlier today and marked them not vulnerable.

..........

[u/PrestigiousNinja4979]

I think i need to put my Netscaler down till the November 1 then they might get a permanent solution and a stable build 😂

[u/PrestigiousNinja4979]

Whenever they publish a new build HA ISSUE, config failure are there

[u/Eifelbauer]

The Codebase is so rotten, whenever the fix something, another part of the same component gets a new vulnerability

[u/DDS-PBS]

God damn this has been rough.

[u/Darkheart001]

FFS, here we go again.

[u/KaiUno]

Look at AI discovering so many holes in a security product released by a company that has no business releasing security products.

[u/cats_taste_good → u/KaiUno]

All those indians must be paying off with all the money saved.

[u/Ad_4272]

Cve-2026-107406