Citrix Patches Critical Net Scaler Flaw That Could Enable RCE in SAML Deployments

Summary: Citrix released patches for CVE-2026-107406, a memory overflow vulnerability in NetScaler ADC and NetScaler Gateway with a CVSS score of 9.5 out of 10.0 that can lead to remote code execution or denial-of-service when the appliances are configured as a SAML identity provider or service provider. Citrix said there is no evidence of exploitation in the wild and credited Michael Tucker, Chew Keong Tan, and Alex Bernier of the JPMorgan Chase XOR Team, along with Maxim Suhanov, for reporting the flaw.
Key Takeaway: Exploitation depends on a configuration many organizations run deliberately - NetScaler as a SAML IdP or SP - and Secure Private Access Hybrid deployments on NetScaler are affected too, so the patch list may be longer than the team expects. The same product line already has three other flaws (CVE-2026-88771, CVE-2026-88772, CVE-2026-88779) under active exploitation in the wild.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-107406
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026