Citrix Patches Critical NetScaler Flaw That Could Enable RCE in SAML Deployments
Citrix patches critical NetScaler flaw enabling RCE in SAML deployments.
Citrix has released patches for a critical security vulnerability (CVE-2026-107406) in NetScaler ADC and NetScaler Gateway that could lead to remote code execution or denial-of-service. The flaw, with a CVSS score of 9.5, affects specific versions when configured as a SAML identity provider or service provider. While there's no evidence of active exploitation, successful exploitation requires specific SAML configurations.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Citrix?
Get an email when a new story names Citrix, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical vulnerability (CVE-2026-107406) in Citrix NetScaler ADC and NetScaler Gateway, scoring 9.5 on the CVSS scale, exposes organizations to remote code execution and denial-of-service attacks when systems are configured as SAML identity or service providers. The root issue lies in unpatched network appliances serving as authentication gateways — a high-value target because compromising them can grant attackers broad access to downstream systems and user identities. Although active exploitation has not yet been observed, the severity and the prevalence of SAML-based SSO deployments in enterprise environments make this a high-priority risk. This incident underscores how specific configuration choices (SAML IdP/SP roles) can dramatically expand the attack surface of otherwise standard infrastructure components.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-107406