Citrix Urges Immediate Patching of Critical NetScaler Vulnerability

CVE-2026-107406 is a memory overflow in NetScaler ADC and NetScaler Gateway that can lead to remote code execution or denial of service. It is reachable over the network without authentication or user interaction, but only when the appliance is configured as a SAML service provider or SAML identity provider, and only on the version ranges listed for each role; attack complexity is rated high. A successful attack can compromise confidentiality and integrity of the appliance and can also affect connected systems, or can crash the service. Citrix appliances in the named 14.1, 14.1-FIPS, 13.1, and 13.1-FIPS ranges are affected when those SAML roles are enabled. It is not listed in CISA KEV, and no public proof-of-concept is known.

Do: Upgrade NetScaler ADC and NetScaler Gateway, including FIPS builds, to a vendor-fixed release newer than every range listed as vulnerable, and apply the advisory to both SAML service-provider and identity-provider roles. Until then, disable unused SAML SP or IdP configuration and prioritize internet-facing gateways. Confirm the running build and SAML role, and watch for crashes or unexpected management-plane behavior.

CVE-2026-88772 is a critical flaw in Citrix NetScaler ADC and NetScaler Gateway that can lead to remote code execution or denial of service. It is reachable over the network with no privileges and no user interaction, though attack complexity is rated high; successful exploitation can fully compromise the appliance and affect systems behind it. Affected builds are ADC before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP, and Gateway before 14.1-73.37 and before 13.1-64.23. Organizations running those releases as internet-facing ADC or VPN gateways are at risk. Citrix-linked reporting describes active zero-day exploitation; no public proof-of-concept is known and the issue is not listed in CISA KEV.

Do: Upgrade NetScaler ADC and Gateway to 14.1-73.37 or 13.1-64.23 (or later), and FIPS/NDcPP ADC builds to 14.1-73.37 FIPS or 13.1.37.279 FIPS and NDcPP (or later). Treat unpatched internet-facing appliances as potentially compromised: review admin and VPN logs, config changes, and unusual processes, and restrict management interfaces until patched.

CVE-2026-88779 is a high-severity vulnerability (CVSS 4.0 base score 8.7) in Citrix NetScaler ADC and NetScaler Gateway. CVSS metrics indicate it can be triggered remotely over the network with low complexity, no privileges, and no user interaction; the advisory text does not name a specific bug class or request path. Impact is limited to high loss of availability on the vulnerable appliance, with no confidentiality or integrity impact scored for the device or for subsequent systems, which is consistent with denial of service. Affected products are NetScaler ADC before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282, and NetScaler Gateway before 14.1-73.41 and before 13.1-64.28. It is not listed in CISA KEV, and no public proof-of-concept is known.

Do: Upgrade NetScaler ADC to 14.1-73.41 or later, 13.1-64.28 or later, 14.1-73.41 FIPS or later, or 13.1-37.282 or later, and NetScaler Gateway to 14.1-73.41 or 13.1-64.28 or later, matching the correct non-FIPS or FIPS train. Until those builds are in place, restrict ADC and Gateway services to trusted networks and monitor for unexpected restarts or loss of availability.