Citrix patches CVE-2026-107406 in NetScaler

Citrix released fixes for CVE-2026-107406 in NetScaler ADC and NetScaler Gateway, a critical flaw with a CVSS score of 9.5 that can lead to remote code execution or denial of service under specific SAML configuration conditions. The company said it was not aware of any unmitigated exploits when it issued the notice and asked customers to update affected instances immediately.

What systems are affected?

The flaw affects customer-managed NetScaler ADC and NetScaler Gateway appliances running vulnerable versions and configured with the applicable SAML functionality. According to The Hacker News and The Register, the impacted ranges vary by SAML role and product branch, so not every deployment is exposed in the same way.

The Hacker News listed affected versions including 14.1-73.37 through 14.1-73.41 and 13.1-64.23 through 13.1-64.28 for specific SAML configurations, along with related FIPS branches. The Register said that in certain builds, the risk applies when NetScaler operates as an identity provider or a service provider, while in newer builds it may be limited to identity provider mode.

What versions did Citrix patch?

Citrix released fixed builds for NetScaler ADC and Gateway 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS, and 13.1.37.283 for the applicable FIPS and NDcPP branches. NetScaler's official documentation says CVE-2026-107406 should be remediated from the affected instances tab in NetScaler Console.

SOCRadar also reported that the vulnerability affects customer-managed devices running vulnerable versions with the applicable SAML functionality enabled. The same source said Citrix has already published fixed builds.

What context does the case add in Peru?

An assessment of Peruvian companies cited by Agencia Andina identified misconfigurations in servers and cloud services among the most common vulnerabilities seen during the six-month period analyzed. The review does not confirm a specific cloud breach or measure regional impact, but it does show recurring exposure in enterprise environments.

The NetScaler case adds to that picture because it targets customer-managed devices and SAML-enabled deployments, a scenario that depends on each organization’s specific configuration. As of the notice cited by BleepingComputer, Citrix said it was not aware of unmitigated exploits for the vulnerability and repeated its call to apply patches without delay.