Citrix urges patches for new NetScaler RCE amid exploited flaws

Citrix urges immediate patches for critical NetScaler CVE-2026-107406; no known exploits, unlike several recently abused flaws.

Citrix bulletin CTX697191, published October 8, 2026, discloses CVE-2026-107406, a critical memory-overflow flaw (CWE-119, CVSS v4.0 9.5) in customer-managed NetScaler ADC and NetScaler Gateway. An unauthenticated attacker could achieve remote code execution or denial of service when an appliance is configured as a SAML identity provider or service provider; attack complexity is high, and Secure Private Access Hybrid deployments that use NetScaler are also in scope. Citrix said it was not aware of unmitigated exploitation and credited the JPMorgan Chase XOR Team and Maxim Suhanov; fixed builds include 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS, and 13.1-37.283 and later, with NDcPP releases also listed, while sources differ on whether Citrix-managed cloud is vendor-updated or excluded. Separately, CVE-2026-88771—described as pre-authentication command injection or command execution and scored 9.5—was exploited before September 27, 2026 fixes in 14.1-73.37 and 13.1-64.23; LevelBlue reported reverse shells, Perl and Python payloads, superuser sec_monitor, ns.conf theft, and a PHP web shell, beyond an earlier SOCRadar headline that only described a large command-and-control operation. Sources also cite exploited zero-days CVE-2026-88772, targeted since at least early September according to The Register, and CVE-2026-88779, which SOCRadar calls a high-severity memory overflow and Security Affairs calls a DoS flaw added to CISA's KEV catalog; BleepingComputer says Shadowserver tracks more than 21,000 exposed NetScaler IPs.