The Cybersecurity and Infrastructure Security Agency on Friday urged organizations to patch their Citrix systems after the company announced another critical vulnerability in NetScaler ADC and NetScaler Gateway.
Citrix on Thursday warned of a memory overflow vulnerability, tracked as CVE-2026-107406, which could lead to remote code execution or denial of service. The flaw has a severity score of 9.5 out of 10.
To be affected by the vulnerability, the company said, NetScaler ADC or NetScaler Gateway needed to be configured as SAML SP or SAML IdP. The company cautioned it was not aware of the flaw being exploited, but urged customers to immediately upgrade their NetScaler instances to a recommended version.
The latest disclosure is certain to raise additional concerns for network defenders already struggling to manage a wave of ongoing attacks.
“The latest vulnerability, CVE-2026-107406, is, of course, worrying, and customers should apply the latest vendor updates to remediate this on an urgent basis,” Stephen Fewer, senior security researcher at Rapid7 told Cybersecurity Dive. “However there is no successful exploitation publicly reported at this time, and given that CVE-2026-107406 is a memory corruption vulnerability, broad successful exploitation across unpatched appliances is less likely than that of CVE-2026-88771.”
The warning marked the latest security concern for NetScaler after a wave of critical flaws impacted thousands of customers.
Key enterprise tool
NetScaler is used by enterprises across the globe for load balancing, authentication and other needs. It is also a lucrative target for hackers.
In late September, the company disclosed eight vulnerabilities, including two zero-day flaws that were facing active exploitation: a remote code execution flaw, tracked as CVE-2026-88771, and a memory-buffer vulnerability, tracked as CVE-2026-88772, exploited as zero days dating back to August, according to security researchers.
When Dutch authorities flagged exploitation activity, Citrix customers across the globe were warned in a flurry of urgent calls in late September to disconnect their systems. Multiple hospitals did so in response, briefly denying patient access to service portals.
Researchers at Google Threat Intelligence Group warned that dozens of organizations across multiple industries were impacted by the attacks. Custom PHP web shells were discovered in victim environments, designed to enable reconnaissance and disguise command-and-control payloads.
Shadowserver Foundation estimated at the time that more than 20,000 instances were visible and potentially at risk.
Earlier this month, Citrix urged customers to patch a memory-overflow vulnerability in NetScaler, tracked as CVE-2026-88779. That became the third critical flaw to come under exploitation.
CISA warned that hackers were also exploiting CVE-2026-88779 to force systems to reboot, which would allow them to execute code previously injected using CVE-2026-88771.
Editor’s note: Updates with comment from Rapid7.
