Citrix urges NetScaler patching for critical remote code execution flaw

Citrix urged administrators to patch a critical vulnerability that can let attackers execute code remotely or crash NetScaler ADC and NetScaler Gateway appliances. The memory overflow flaw, CVE-2026-107406, affects appliances configured to act as an identity provider or service provider using Security Assertion Markup Language, a protocol for exchanging authentication information. Citrix recommends upgrading to fixed versions, including 14.1-73.46 or later and 13.1-64.29 or later releases of 13.1, with separate updates for FIPS and NDcPP editions. The company said it had found no evidence of exploitation in the wild. Internet exposure counts do not establish how many devices have vulnerable configurations or remain unpatched.