De Vector

Citrix warns of new critical NetScaler vulnerability

Organisations with SAML configurations should immediately check the latest patches and guidance, security agencies say.

Citrix has reported a new critical vulnerability in NetScaler ADC and NetScaler Gateway. Under specific SAML configurations, the flaw could allow remote code execution or a denial-of-service attack.

The vulnerability is designated CVE-2026-107406. According to Citrix, it is a memory overflow in NetScaler ADC and NetScaler Gateway. The risk applies to systems configured as a SAML service provider or SAML identity provider and meeting additional software-version conditions.

According to Citrix’s description, an attacker could exploit the flaw to execute code remotely or make a system unavailable. This does not mean that every NetScaler installation is vulnerable in the same way. The configuration, software version and enabled features are decisive.

The Australian Cyber Security Centre published a warning on Friday and calls the vulnerability critical. The agency stresses that earlier patches for other NetScaler problems do not fix this new flaw. Organisations should therefore recheck their current version and SAML setup.

The warning follows a series of NetScaler vulnerabilities about which security researchers and governments have already warned in recent weeks. The Australian Cyber Security Centre previously reported that at least two other vulnerabilities were actively exploited worldwide before a patch became available.

Citrix refers to specific firmware versions and configuration instructions for the solution. According to the company, organisations should update their systems and check for signs of exploitation. Those making NetScaler externally accessible should also determine whether log files show unusual activity and whether access credentials have been compromised.

The impact could be significant because NetScaler is often used as a gateway to corporate networks. A successful attack could affect remote access, identity verification and application availability. The article does not say that Dutch organisations have been affected; no public confirmation was found.

Security advisers recommend not delaying the patch until a regular maintenance cycle if an organisation meets the vulnerable conditions. At the same time, administrators should first establish which version and configuration are active, so that remediation measures are not applied incorrectly.

The main uncertainty is the extent of actual exploitation of this specific vulnerability. The Australian warning calls the vulnerability new and critical, but does not confirm concrete exploitation at Australian organisations. Citrix and governments will publish additional technical indicators as they become available.

Respond to this article

← Back to the edition