Citrix issues its weekly critical security patch for NetScaler ADC and NetScaler Gateway

CVE-2026-107406 is a memory overflow in NetScaler ADC and NetScaler Gateway that can lead to remote code execution or denial of service. It is reachable over the network without authentication or user interaction, but only when the appliance is configured as a SAML service provider or SAML identity provider, and only on the version ranges listed for each role; attack complexity is rated high. A successful attack can compromise confidentiality and integrity of the appliance and can also affect connected systems, or can crash the service. Citrix appliances in the named 14.1, 14.1-FIPS, 13.1, and 13.1-FIPS ranges are affected when those SAML roles are enabled. It is not listed in CISA KEV, and no public proof-of-concept is known.

Do: Upgrade NetScaler ADC and NetScaler Gateway, including FIPS builds, to a vendor-fixed release newer than every range listed as vulnerable, and apply the advisory to both SAML service-provider and identity-provider roles. Until then, disable unused SAML SP or IdP configuration and prioritize internet-facing gateways. Confirm the running build and SAML role, and watch for crashes or unexpected management-plane behavior.

CVE-2026-3055 is an out-of-bounds read (CWE-125) in Citrix NetScaler ADC and NetScaler Gateway caused by insufficient input validation when the appliance is configured as a SAML Identity Provider (IDP). An unauthenticated remote attacker can trigger the flaw by sending crafted input to the SAML IDP functionality, causing the appliance to read beyond the bounds of allocated memory and potentially disclose sensitive information from it. The CVSS 4.0 base score of 9.3 (critical) reflects a network-vector flaw requiring no privileges or user interaction. Only organizations running NetScaler ADC or NetScaler Gateway appliances with SAML IDP configured are affected, according to the available data. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-03-30, carries an 87.2% EPSS probability of exploitation within 30 days, has a public proof-of-concept, and headlines indicate active reconnaissance and exploitation against NetScaler deployments, including federal patch directives.

Do: Apply the patched NetScaler ADC and NetScaler Gateway releases from Citrix's advisory as soon as possible, prioritizing internet-facing appliances (exact fixed version numbers are not in this data; check the vendor bulletin). Determine whether SAML IDP is configured on your appliances and, if it is not needed, disable or unbind it as an interim mitigation while reviewing appliance logs for suspicious authentication or reconnaissance traffic. Federal agencies must follow the CISA required action and BOD 22-01 guidance, with CISA directing patching by the stated Thursday deadline.

CVE-2026-88779 is a high-severity vulnerability (CVSS 4.0 base score 8.7) in Citrix NetScaler ADC and NetScaler Gateway. CVSS metrics indicate it can be triggered remotely over the network with low complexity, no privileges, and no user interaction; the advisory text does not name a specific bug class or request path. Impact is limited to high loss of availability on the vulnerable appliance, with no confidentiality or integrity impact scored for the device or for subsequent systems, which is consistent with denial of service. Affected products are NetScaler ADC before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282, and NetScaler Gateway before 14.1-73.41 and before 13.1-64.28. It is not listed in CISA KEV, and no public proof-of-concept is known.

Do: Upgrade NetScaler ADC to 14.1-73.41 or later, 13.1-64.28 or later, 14.1-73.41 FIPS or later, or 13.1-37.282 or later, and NetScaler Gateway to 14.1-73.41 or 13.1-64.28 or later, matching the correct non-FIPS or FIPS train. Until those builds are in place, restrict ADC and Gateway services to trusted networks and monitor for unexpected restarts or loss of availability.