Citrix issues emergency patch for critical NetScaler vulnerability

Citrix has issued emergency security updates to fix a new critical flaw affecting NetScaler ADC networking appliances and NetScaler Gateway remote access tools, BleepingComputer reported. BankInfoSecurity, The Register, and SecNews.gr also report that Citrix released emergency fixes for the security flaw. BleepingComputer reported that Citrix urged system administrators to apply the patch immediately. [1][2][3][4]

The vulnerability is tracked as CVE-2026-107406, according to BleepingComputer. The security weakness is caused by a memory overflow issue. BleepingComputer reported that hackers can exploit this flaw to execute remote code on affected devices or cause a denial of service. [4]

NetScaler was originally developed in 1997 and acquired by Citrix Systems in 2005. Citrix consolidated its networking tools under the NetScaler brand in 2016. NetScaler later became a business unit under Cloud Software Group in September 2022. [8]

As FTMQ Security reported earlier, Citrix issued emergency updates earlier in October 2026 for a separate zero-day memory overflow vulnerability tracked as CVE-2026-88779. That earlier flaw caused a denial of service in appliances using SAML authentication with Gateway and was under active exploitation. [9][10]