Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.
Government officials will never ask you to transfer money or disclose bank log-in details over a phone call.

Call the 24/7 ScamShield Helpline at 1799 if you are unsure if something is a scam.

Cyber Security Agency of Singapore
Alerts

Critical Vulnerability in Citrix NetScaler ADC and NetScaler Gateway

12 October 2026

Attackers can exploit a critical vulnerability in Citrix NetScaler ADC and NetScaler Gateway to perform remote code execution or cause a denial of service on the affected system. Patch immediately.

Background

Citrix has released security updates to address a memory overflow vulnerability (CVE-2026-107406) affecting Citrix NetScaler ADC and NetScaler Gateway. This vulnerability has a Common Vulnerability Scoring System (CVSS v4.0) score of 9.5 out of 10.

Impact

Due to a vulnerability involving improper restriction of operations within the bounds of a memory buffer in NetScaler ADC and NetScaler Gateway, an unauthenticated remote attacker could exploit affected appliances configured as a SAML Service Provider (SP) or SAML Identity Provider (IdP) to perform remote code execution or cause a denial of service.

Affected Products

This vulnerability affects NetScaler ADC and NetScaler Gateway deployments configured as a SAML SP or SAML IdP. The following versions are affected:

Applicable only when configured as a SAML IdP:

  • NetScaler ADC and NetScaler Gateway between 14.1-73.37 and 14.1-73.41, inclusive

  • NetScaler ADC 14.1-FIPS between 14.1-73.37 FIPS and 14.1-73.41 FIPS, inclusive

  • NetScaler ADC and NetScaler Gateway between 13.1-64.23 and 13.1-64.28, inclusive

  • NetScaler ADC 13.1-FIPS between 13.1-NDcPP 13.1-37.279 and 13.1-37.282, inclusive

Applicable when configured as a SAML SP or SAML IdP:

  • NetScaler ADC and NetScaler Gateway before 14.1-73.37

  • NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS

  • NetScaler ADC and NetScaler Gateway before 13.1-64.23

  • NetScaler ADC 13.1-FIPS before 13.1-NDcPP 13.1-37.279

Note: Secure Private Access Hybrid deployments that use NetScaler instances are also affected and should be updated to the recommended versions.

Recommendations

Users and administrators of affected products are advised to update to the latest versions immediately. Administrators should also verify whether their NetScaler appliances are configured as a SAML SP or SAML IdP by checking for the following configuration entries:

  • An Appliance is configured as a SAML SP: add authentication samlAction

  • An Appliance is configured as a SAML IdP: add authentication samlIdPProfile

References

https://support.citrix.com/external/article/CTX697191 (opens in new tab)

https://nvd.nist.gov/vuln/detail/CVE-2026-107406 (opens in new tab)

https://thehackernews.com/2026/10/citrix-patches-critical-netscaler-flaw.html (opens in new tab)