Skip to content
Today
Sections

Security Widely confirmed5 publishers 2 min read Published Updated

SAML role decides which NetScaler appliances Citrix's new RCE flaw can reach

Citrix urged NetScaler customers to patch CVE-2026-107406, a memory overflow that allows remote code execution on appliances set up as SAML IdP or SP. The company says it knows of no attacks so far, on a product line where it has patched exploited zero-days twice in recent weeks.

The Watch · Security desk

Send a correction

Illustration accompanying SAML role decides which NetScaler appliances Citrix's new RCE flaw can reach
Generated illustration
Exposed NetScalers: nearly 20,000 ADC vs 1,500 Gateway Internet-exposed NetScaler fingerprints tracked by Shadowserver, by product. Counts do not show which are patched, honeypots or SAML-configured.

Bar comparison of Shadowserver's internet scan of NetScaler fingerprints: nearly 20,000 NetScaler ADC appliances versus just over 1,500 NetScaler Gateway instances. The scan cannot tell which are patched, honeypots or configured as SAML IdP or SP.

Shadowserver internet scan of exposed NetScaler fingerprints In instances

Exposed NetScalers: nearly 20,000 ADC vs 1,500 Gateway (Shadowserver internet scan of exposed NetScaler fingerprints)
ItemValueClaim
NetScaler ADC (nearly)20,000 instances15
NetScaler Gateway (just over)1,500 instances15

What happened

  • SecurityWeek reports a CVSS score of 9.5, and the same overflow can be used for denial of service as well as code execution.
  • Fixed builds are 14.1-73.46 and 13.1-64.29 for ADC and Gateway, 14.1-73.46 FIPS, and 13.1.37.283 for the 13.1-FIPS and 13.1-NDcPP releases.
  • Secure Private Access Hybrid deployments that use NetScaler are also affected and need the same upgrade, according to SecurityWeek.
  • Shadowserver tracks more than 21,000 IP addresses on the internet showing NetScaler fingerprints.

Why it matters

  • Who has to decide decision Admins can sort a NetScaler fleet by one setting, the SAML IdP or SP role, and move those appliances to the fixed builds first.
  • What it limits constraint Internet scan counts cannot show which exposed boxes are honeypots, already patched or SAML-configured, so sizing exposure depends on each operator's own configuration inventory.
  • What it sets up precedent CISA has listed 27 Citrix flaws as exploited since November 2021, seven of them in ransomware attacks. On that record, Citrix's current no-known-exploitation status is best treated as temporary.

The SAML role is a necessary condition. Citrix says an ADC or Gateway appliance has to be configured as a SAML Identity Provider or Service Provider to be vulnerable [3]. SecurityWeek's summary of the advisory narrows it further, to SAML appliances "under specific configuration conditions" [4]. Neither report lists those conditions. Until an appliance with a SAML role has been checked against the advisory text or upgraded, it belongs on the exposed list.

Shadowserver's numbers do not narrow the field. Its count splits into just over 1,500 Gateway instances and nearly 20,000 ADC appliances [15]. ADC boxes are more than nine in ten of the exposed fingerprints [18]. Both product lines are vulnerable when they hold a SAML role [3].

On exploitation, the public record is the vendor's statement. "As of the publication of the bulletin, Citrix is not aware of any unmitigated exploits of this vulnerability," the company said in the bulletin it issued Thursday [6] [7]. "We strongly urge affected customers to review the advisory and upgrade impacted NetScaler instances to the recommended versions as soon as possible," Citrix said [5].

The NetScaler bugs before this one were used in attacks. Citrix patched two zero-days in September, CVE-2026-88771 and CVE-2026-88772. According to BleepingComputer, they let attackers deploy custom web shells and tunneling malware, steal credentials, gain root access and spread into internal networks [10]. SecurityWeek reported they were used against government, financial services, education, legal and professional services organizations [12]. BleepingComputer also counts CVE-2026-3055 and CVE-2026-4368, patched in March, among the NetScaler flaws attackers have abused this year [17].

Citrix shipped emergency updates earlier this month for CVE-2026-88779, a zero-day it described as denial of service. Researchers and admins later said that flaw could also be exploited for remote code execution, BleepingComputer reported [11]. The code-execution claim came from outside Citrix. For CVE-2026-107406, the advisory lists code execution as a possible outcome from the start [1].

What to watch

  • Whether Citrix revises its exploitation statement or CISA adds CVE-2026-107406 to its exploited-vulnerabilities list.
  • Publication of technical analysis or proof-of-concept code for the memory overflow.
  • Whether Shadowserver starts reporting how many exposed NetScaler hosts remain unpatched or run a SAML role.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence83
Adoption60
Hype gap+12
Incentives42
Confidence84

Perspective Coverage

5 publishers
Builder
Builder 30%
Operator
Operator 61%
Investor
Investor 9%
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    Citrix warned administrators to patch immediately against CVE-2026-107406, a memory overflow weakness in NetScaler ADC and NetScaler Gateway that attackers can exploit to gain remote code execution or trigger a denial-of-service state.

    Reported SupportedView cited source
  2. [2]

    CVE-2026-107406 has a CVSS score of 9.5 and is described as a memory overflow that could lead to remote code execution or denial of service.

    Reported Supported Source: SecurityWeekView cited source
  3. [3]

    To be vulnerable, NetScaler ADC and NetScaler Gateway appliances must be configured as a SAML Identity Provider (IdP) or Service Provider (SP).

    Reported SupportedView cited source
  4. [4]

    According to Citrix, the defect impacts NetScaler ADC and Gateway appliances configured as a SAML SP or SAML IdP, "under specific configuration conditions."

    Reported Supported Source: SecurityWeek, summarizing CitrixView cited source
  5. [5]

    "We strongly urge affected customers to review the advisory and upgrade impacted NetScaler instances to the recommended versions as soon as possible,"

    Reported Supported Source: CitrixView cited source
  6. [6]

    "As of the publication of the bulletin, Citrix is not aware of any unmitigated exploits of this vulnerability."

    Reported Supported Source: CitrixView cited source
  7. [7]

    Citrix issued the warning about CVE-2026-107406 on Thursday.

    Reported SupportedView cited source
  8. [8]

    Fixed versions: NetScaler ADC and Gateway 14.1-73.46 and later; 13.1-64.29 and later releases of 13.1; NetScaler ADC 14.1-FIPS 14.1-73.46 FIPS and later; 13.1-FIPS and 13.1-NDcPP 13.1.37.283 and later.

    Reported SupportedView cited source
  9. [9]

    The bug also affects Secure Private Access Hybrid deployments that use NetScaler, and customers need to update those NetScaler instances as well.

    Reported Supported Source: SecurityWeekView cited source
  10. [10]

    In September, Citrix released security updates for two actively exploited NetScaler RCE zero-days, CVE-2026-88771 and CVE-2026-88772, that let attackers deploy custom web shells and tunneling malware, steal credentials, gain root access, and spread into victims' internal networks.

    Reported Supported Source: BleepingComputerView cited source
  11. [11]

    Earlier this month, Citrix issued emergency updates for a NetScaler denial-of-service zero-day, CVE-2026-88779, that researchers and admins later said could also be exploited to gain remote code execution.

    Reported Supported Source: BleepingComputerView cited source
  12. [12]

    CVE-2026-88771 and CVE-2026-88772 have been exploited in attacks against government, financial services, education, legal, and professional services organizations.

    Reported Supported Source: SecurityWeekView cited source
  13. [13]

    Shadowserver tracks over 21,000 IP addresses with NetScaler fingerprints exposed on the internet.

    Reported SupportedView cited source
  14. [14]

    There is no information on how many of the Shadowserver-tracked NetScaler instances are honeypots, have already been patched, or have vulnerable configurations.

    Reported SupportedView cited source
  15. [15]

    Shadowserver's count includes just over 1,500 Gateway instances and nearly 20,000 NetScaler ADC appliances.

    Reported SupportedView cited source
  16. [16]

    CISA has flagged 27 actively exploited Citrix vulnerabilities since November 2021, including seven abused in ransomware attacks.

    Reported SupportedView cited source
  17. [17]

    In March, Citrix urged customers to patch CVE-2026-3055 and CVE-2026-4368, which BleepingComputer cites among NetScaler vulnerabilities attackers have abused since the start of the year.

    Reported Supported Source: BleepingComputerView cited source
  18. [18]

    ADC appliances make up more than nine in ten of the internet-exposed NetScaler fingerprints Shadowserver tracks.

    Derived Supported

Sources

5 independent publishers whose own reporting we read for this story.

  1. bleepingcomputer.com

    1 article · October 9, 2026

    Citrix warns admins to patch new NetScaler RCE flaw immediately
  2. dev.to

    1 article · October 9, 2026

    Citrix NetScaler CVE-2026-107406: Pre-Authentication RCE and DoS via SAML Configuration
  3. securityaffairs.com

    1 article · October 9, 2026

    CVE-2026-107406: Citrix Fixes Critical NetScaler ADC and Gateway Vulnerability
  4. securityweek.com

    1 article · October 8, 2026

    Citrix Urges Immediate Patching of Critical NetScaler Vulnerability
  5. thehackernews.com

    1 article · October 9, 2026

    Citrix Patches Critical NetScaler Flaw That Could Enable RCE in SAML Deployments

Topics and entities

Topics

Entities