1.0 Introduction
Recently, Citrix has released security updates to address a critical vulnerability (CVE-2026-107406) in NetScaler ADC and NetScaler Gateway. It follows another SAML-related NetScaler flaw, CVE-2026-88779, which was exploited in zero-day attacks.
2.0 Impact
Successful exploitation of this memory overflow vulnerability may allow an unauthenticated remote attacker to trigger memory corruption, resulting in arbitrary code execution or denial of service. This may lead to full compromise of the appliance, which sits at the network edge and handles authentication, and unauthorised access to internal networks.
3.0 Affected Products
Vulnerable only if the appliance is configured as a SAML Service Provider (SP) or SAML Identity Provider (IdP). Affected versions:
- NetScaler ADC and NetScaler Gateway before 14.1-73.37 (SAML SP or IdP)
- NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS (SAML SP or IdP)
- NetScaler ADC and NetScaler Gateway before 13.1-64.23 (SAML SP or IdP)
- NetScaler ADC and NetScaler Gateway 14.1-73.37 to 14.1-73.41 (SAML IdP only)
- NetScaler ADC and NetScaler Gateway 13.1-64.23 to 13.1-64.28 (SAML IdP only)
4.0 Recommendation
CyberSecurity
Malaysia encourages users and administrators to review the following Citrix
security bulletin and apply the necessary updates. Customers are advised to
upgrade to NetScaler ADC and NetScaler Gateway 14.1-73.46 or later, 13.1-64.29
or later releases of 13.1, or NetScaler ADC 14.1-FIPS 14.1-73.46 FIPS or later.
Administrators should check whether their appliances use SAML authentication,
review authentication logs for anomalous activity, and prioritise
internet-facing appliances.
Kindly refer to the following URL:
Generally, we advise users to be
updated with the latest security announcements by the vendor and follow best
practice security policies to determine which updates should be applied.
For further enquiries, please contact Cyber999
Incident Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: https://www.cybersecurity.my
5.0 References