Citrix Patches Critical RCE Flaw in NetScaler ADC & Gateway

New Critical RCE Flaw Found in Patched Citrix NetScaler Appliances

CRITICAL
October 12, 2026
4m read
VulnerabilityPatch Management

Related Entities

Organizations

Citrix

CVE Identifiers

CVE-2026-107406
CRITICAL
CVSS:9.5
CVEDetails.com CVE.org

MITRE ATT&CK Techniques

T1190Initial Access

Exploit Public-Facing Application

T1068Privilege Escalation

Exploitation for Privilege Escalation

T1110Credential Access

Brute Force

Full Report

Executive Summary

Citrix has released an emergency security update for a new critical vulnerability in its NetScaler ADC and NetScaler Gateway appliances. The flaw, tracked as CVE-2026-107406, is a memory overflow vulnerability with a CVSS v4.0 score of 9.5. It can be exploited by a remote, unauthenticated attacker to achieve remote code execution (RCE) or cause a denial of service. The situation is particularly urgent because the vulnerability persists even in builds that were recently patched to address a series of actively exploited zero-days. Organizations that applied the September patches may still be at risk and must upgrade their appliances again.

Vulnerability Details

  • CVE ID: CVE-2026-107406
  • Severity: Critical (CVSS 9.5)
  • Type: Memory Overflow
  • Impact: Unauthenticated Remote Code Execution or Denial of Service
  • Description: The vulnerability exists in the SAML processing component of the NetScaler appliances. An attacker can send a specially crafted request to a vulnerable appliance, triggering a memory overflow which can then be leveraged for RCE.

Affected Systems

The vulnerability's exposure is configuration-dependent:

  • Older Builds (before September patches): Appliances are vulnerable if configured as a SAML service provider (SP) OR a SAML identity provider (IdP).
  • Recently Patched Builds (e.g., 14.1-73.37 to 14.1-73.41 and 13.1-64.23 to 13.1-64.28): Appliances are still vulnerable if configured as a SAML identity provider (IdP).

This means organizations that diligently patched the last round of zero-days are not necessarily safe from this new flaw and must take action again.

Exploitation Status

As of the disclosure on October 10, 2026, Citrix stated it is not aware of any active exploitation of CVE-2026-107406 in the wild. However, given the history of rapid weaponization of NetScaler vulnerabilities, the risk of exploitation is extremely high. Security teams should assume that threat actors are actively developing exploits.

Impact Assessment

A successful RCE exploit against a NetScaler appliance would be devastating. These devices are typically deployed at the network edge and handle sensitive traffic, including authentication.

  • Network Compromise: An attacker with RCE on a NetScaler appliance has a powerful foothold at the perimeter of the network, from which they can pivot to attack internal resources.
  • Authentication Bypass: If the appliance is used as a gateway or IdP, an attacker could potentially intercept or manipulate authentication sessions, gaining access to protected applications.
  • Data Theft: The attacker could decrypt SSL/TLS traffic passing through the compromised appliance, stealing sensitive data and credentials.
  • Denial of Service: A less sophisticated attack could simply crash the appliance, causing a major network outage for the organization.

Cyber Observables — Hunting Hints

While there are no public exploits, hunting can focus on anomalous SAML-related traffic.

Type
url_pattern
Value
/saml/
Description
Look for malformed or unusually large SAML requests/responses in web logs, which could indicate fuzzing or exploit attempts.
Context
Web server logs, WAF logs
Confidence
medium
Type
log_source
Value
NetScaler Appliance Logs (ns.log)
Description
Monitor for crash events or memory-related errors in the system logs, which could be a sign of failed exploitation attempts.
Context
Syslog, SIEM
Confidence
high
Type
process_name
Value
nsppe
Description
The NetScaler Packet Processing Engine process crashing or exhibiting high CPU/memory usage could indicate an attack.
Context
Appliance CLI monitoring, SNMP
Confidence
medium

Detection Methods

  1. Log Analysis: Ingest NetScaler logs into a SIEM and create alerts for patterns indicative of memory corruption or crashes related to the nsppe process. This leverages D3-PA - Process Analysis.
  2. WAF/IPS Signatures: Deploy virtual patching through WAF or IPS signatures as they become available from security vendors. These can block known exploit patterns before they reach the vulnerable appliance.
  3. Vulnerability Scanning: Use authenticated scans to check the version of NetScaler appliances and their configuration (SAML SP/IdP) to accurately identify vulnerable systems.

Remediation Steps

  1. URGENT PATCHING: The only effective remediation is to upgrade all affected NetScaler ADC and Gateway appliances to a patched version immediately. The recommended versions are:
    • 14.1-73.46 and later
    • 13.1-64.29 and later
    • Corresponding FIPS and NDcPP builds.
  2. Review SAML Configuration: As a temporary measure, if an appliance cannot be patched immediately, review its configuration. If it is configured as a SAML IdP and this functionality is not essential, consider disabling it to reduce the attack surface. This is a temporary workaround and not a substitute for patching.
  3. Threat Hunting: After patching, proactively hunt for any signs of compromise that may have occurred before the patch was applied. Review logs for any anomalous activity originating from the NetScaler appliances.

Timeline of Events

1
October 10, 2026
Citrix discloses CVE-2026-107406 and releases emergency patches.
2
October 12, 2026
This article was published

MITRE ATT&CK Mitigations

Update Software

M1051enterprise

Applying the latest security patches from Citrix is the most critical and effective mitigation.

Mapped D3FEND Techniques:

D3-SU

Disable or Remove Feature or Program

M1042enterprise

As a temporary workaround, disable SAML IdP functionality if it is not required, to reduce the immediate attack surface.

Mapped D3FEND Techniques:

D3-ACH

Network Intrusion Prevention

M1031enterprise

Use a WAF or IPS to apply virtual patching rules that can detect and block exploit attempts against this vulnerability.

Mapped D3FEND Techniques:

D3-NTA

Timeline of Events

1
October 10, 2026

Citrix discloses CVE-2026-107406 and releases emergency patches.

Sources & References

NetScaler builds that fixed zero-days carry critical flaw, too
iTnews•October 11, 2026
Citrix Ships Another Emergency Fix for NetScaler Appliances
BankInfoSecurity•October 10, 2026
Citrix NetScaler CVE-2026-107406: What TPRM Teams Should Do
Black Kite•October 9, 2026
Critical NetScaler SAML Flaw CVE-2026-107406 That Can Lead to Remote Code Execution
Security Online•October 9, 2026

Article Author

Jason Gomes

Jason Gomes

• Cybersecurity Practitioner

Cybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.

Threat Intelligence & AnalysisSecurity Orchestration (SOAR/XSOAR)Incident Response & Digital ForensicsSecurity Operations Center (SOC)SIEM & Security AnalyticsCyber Fusion & Threat SharingSecurity Automation & IntegrationManaged Detection & Response (MDR)
LinkedIn

Editorial Standards & Analyst Review

CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.

Tags

RCEmemory overflowSAMLADCpatch Tuesday

📢 Share This Article

Help others stay informed about cybersecurity threats

🎯 MITRE ATT&CK Mapped

Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.

🧠 Enriched & Analyzed

Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.

🛡️ Actionable Guidance

Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.

🔗 STIX Visualizer

Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.

⚡ Sigma Generator

Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.