Loading story…
Citrix disclosed CVE-2026-107406, a critical memory-overflow vulnerability in NetScaler ADC and NetScaler Gateway with a CVSS v4.0 score of 9.5. Successful exploitation could cause remote code execution or denial of service, depending on the appliance build and SAML identity-provider or service-provider configuration. Advisory CTX697191 also covers affected appliances used in Secure Private Access Hybrid deployments. Citrix stated that it was not aware of any unmitigated exploits at publication; Beazley Security Labs reported no known public proof of concept or independent technical analysis.
Administrators should verify appliance versions and SAML configurations, then upgrade to the applicable fixed release, including 14.1-73.46 or 13.1-64.29 for standard editions, with separate fixes for FIPS editions. Citrix has not published a workaround; temporary exposure reductions and monitoring can supplement, but not replace, patching. Recent exploitation of three other NetScaler vulnerabilities, including a separate SAML-processing flaw, heightens the urgency. Security teams should investigate suspicious activity on previously exposed appliances, because installing a fix does not establish whether an earlier compromise occurred.
Map this exposure pattern across your cloud, code, and identities.
9 events from the most recent confirmed update back to the earliest known activity.
Citrix published bulletin CTX697191 for a CVSS v4.0 9.5 memory-overflow vulnerability that could allow remote code execution or denial of service in NetScaler ADC and Gateway, depending on software build and SAML configuration. Citrix stated that it was not aware of any unmitigated exploits at publication.
CISA added the exploited NetScaler SAML-processing vulnerability CVE-2026-88779 to its Known Exploited Vulnerabilities catalog.
CISA added both NetScaler vulnerabilities to its Known Exploited Vulnerabilities catalog following their exploitation as zero-days.
Citrix disclosed eight NetScaler vulnerabilities, including the previously exploited CVE-2026-88771 and CVE-2026-88772.
watchTowr reported that exploitation of earlier NetScaler vulnerabilities compromised multiple government agencies and large enterprises, resulting in bulk theft of credentials and secrets. It urged patched organizations to investigate historical compromise and organizations with unpatched internet-facing appliances to assume compromise and begin triage.
Researchers and administrators reported that NetScaler vulnerability CVE-2026-88779 could also enable remote code execution. The flaw had previously been described as allowing denial-of-service attacks that crash authentication services and force appliance reboots.
Citrix released fixes for supported NetScaler branches and urged affected customers to upgrade to the applicable releases, including 14.1-73.46 and 13.1-64.29 for standard editions and separate FIPS/NDcPP builds. Its published guidance did not provide a workaround.
Attackers exploited a memory-overflow vulnerability in NetScaler SAML processing to crash authentication services and force appliance reboots. The flaw affects appliances configured as a SAML service provider or identity provider.
Attackers exploited CVE-2026-88771, an unauthenticated command-execution vulnerability, and CVE-2026-88772, a memory-overflow vulnerability affecting appliances with DTLS enabled, before disclosure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
17 references tracked. Mallory keeps watching after this page renders.
socprime.com
Open sourcecyber.gc.ca
Open sourcetheregister.com
Open sourcesecurityaffairs.com
Open sourcecybersecuritynews.com
Open sourcebankinfosecurity.com
Open sourcelabs.beazley.security
Open sourcecommunity.citrix.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citrix released fixes for six vulnerabilities in **NetScaler ADC** and **NetScaler Gateway**, including **CVE-2026-8451**, a high-severity out-of-bounds read flaw that can leak sensitive memory from appliances configured as a **SAML Identity Provider**. The bug affects customer-managed NetScaler ADC, Gateway, and related **FIPS/NDcPP** variants, and can expose memory contents in the `NSC_TASS` cookie via malformed requests to the `/saml/login` endpoint. Other patched issues include **CVE-2026-8452**, **CVE-2026-8655**, **CVE-2026-10816**, **CVE-2026-10817**, and **CVE-2026-13474**, covering risks such as arbitrary file reads, memory corruption, and denial of service, including a new **HTTP/2 Bomb** attack. Security researchers and defenders reported that **CVE-2026-8451** was exploited in the wild less than 24 hours after public disclosure, with Lupovis observing threat actors scanning exposed NetScaler systems and sending exploit payloads immediately after receiving valid `200 OK` responses. The observed activity matched public technical details released by watchTowr, using malformed SAML `AuthnRequest` data padded to trigger the overread condition. Government and industry advisories urged organizations to patch immediately, disable **SAML IdP** where patching is not possible, review `/saml/login` traffic and `NSC_TASS` cookie values for signs of compromise, restrict management exposure, and follow Citrix incident guidance if exploitation is suspected.
Jul 9, 2026
Attackers have begun attempting to exploit **CVE-2026-19490**, a critical authentication-bypass vulnerability in Citrix NetScaler ADC and NetScaler Gateway. Remote, unauthenticated actors can bypass authentication on susceptible appliances configured as AAA virtual servers or Gateway services when affected firmware versions and SAML Action settings are present; sensor data from Previdian confirms exploitation attempts, though not confirmed successful compromises. Citrix issued fixes on August 19 and urged customers to upgrade affected appliances. Australia’s ACSC and Belgium’s national cybersecurity coordination center have also called for urgent patching, warning that internet-facing edge devices are frequent initial-access targets. Organizations should identify exposed NetScaler instances and vulnerable SAML/VPN configurations, apply the relevant updates, and continue monitoring appliances after remediation. Citrix also disclosed **CVE-2026-19489**, a memory-overflow flaw affecting deployments using SIP ALG with Large Scale NAT groups.
Sep 4, 2026
Citrix disclosed **CVE-2025-6543**, a critical memory overflow vulnerability in **NetScaler ADC** and **NetScaler Gateway** that affects devices configured as a **Gateway** or **AAA virtual server**. The flaw can trigger unintended control-flow redirection and service disruption, leading to **denial of service**, and was assigned a **CVSS v4.0 score of 9.2**. Affected releases include NetScaler ADC and Gateway `14.1` before `14.1-47.46`, `13.1` before `13.1-59.19`, and NetScaler ADC `13.1-FIPS/NDcPP` before `13.1-37.236-FIPS/NDcPP`; Citrix also said **Secure Private Access** on-prem and hybrid deployments using NetScaler instances are impacted. Citrix directed customers to upgrade immediately to fixed builds or discontinue use where no supported update is available, with the issue tracked in Citrix advisory **CTX694826** and the CVE record **CVE-2025-6543**. Follow-on guidance warned that upgrading to `14.1-47.46` or `13.1-59.19` may introduce authentication problems, including broken login pages in environments using **DUO** or **SAML**, and the company published remediation steps for affected deployments.
Jul 24, 2026