Search
Cybersecurity

2 publications · 2 reports

Citrix urges immediate patches for critical NetScaler remote code execution flaw

The Next Interrupt briefing

AI-generated · Updated · · How we work

Citrix is urging administrators to immediately update NetScaler ADC and NetScaler Gateway deployments to address a critical vulnerability tracked as CVE-2026-107406. The security flaw carries a CVSS v4.0 score of 9.5 and can lead to remote code execution or denial of service. [1][2]

What changed

  • The vulnerability involves improper restriction of operations within a memory buffer, affecting older builds configured as a SAML service provider or identity provider, and more recent builds configured as an identity provider. Secure Private Access Hybrid deployments utilizing NetScaler instances also require patching. Citrix stated that it handles necessary updates for its managed cloud services and Adaptive Authentication, while customer-managed deployments must be updated manually. [1]

What remains uncertain

  • Citrix did not state whether the vulnerability was actively exploited as a zero-day before its public disclosure. [1]

Across the publications

2 publications