Critical Remote Code Execution Vulnerability (CVE‑2026‑107406) in Citrix NetScaler ADC & Gateway
What Happened — Citrix disclosed a critical memory‑overflow flaw (CVE‑2026‑107406) that lets an unauthenticated attacker execute code remotely or cause a denial‑of‑service on NetScaler ADC and NetScaler Gateway appliances when they are configured as SAML IdP or SP. No public exploits have been observed, but the vulnerability is actively tracked and the vendor urges immediate patching.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for a continuous vulnerability‑management program that can surface, prioritize, and remediate high‑severity flaws before they are weaponised.
- Provides a concrete evidence point for audit readiness: documented patch cycles, version‑control logs, and proof of remediation satisfy multiple control objectives across frameworks.
- Highlights the importance of configuration‑aware scanning (SAML IdP/SP settings) to avoid blind spots in asset inventories.
Who Is Affected — Cloud‑infrastructure providers, large enterprises, and any organization that runs Citrix NetScaler ADC or Gateway for remote access or load‑balancing.
Recommended Actions
- Run an inventory of all NetScaler ADC/Gateway instances and identify those configured as SAML IdP/SP.
- Apply the vendor‑recommended updates (14.1‑73.46+, 13.1‑64.29+, etc.) immediately.
- Capture patch‑installation logs and update your configuration‑management database to create a defensible audit trail.
- Enable continuous monitoring for CVE‑2026‑107406 exploitation signatures in IDS/EDR feeds.
- Map the remediation steps to your organization’s vulnerability‑management control objective for audit evidence.
Technical Notes
- Vulnerability type: memory overflow leading to remote code execution (RCE) or denial‑of‑service.
- Affected products: Citrix NetScaler ADC and NetScaler Gateway (all versions prior to the patches listed).
- Exploitability: requires the appliance to be acting as a SAML IdP or SP; no known active exploits at time of disclosure.
- CVE: CVE‑2026‑107406 (critical severity).
- Related advisories: prior NetScaler zero‑days (CVE‑2026‑88771, CVE‑2026‑88772, etc.) and CISA alerts on multiple Citrix flaws.