Advisory severityCritical9.5NetScaler (Citrix) Updated

Critical [CVE-2026-107406] Protecting Customers: Immediate Guidance for CVE-2026-107406 in NetScaler ADC and NetScaler Gateway

This critical-severity NetScaler (Citrix) advisory covers CVE-2026-107406 affecting Gateway.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

protecting-customers-immediate-guidance-for-cve-2026-107406-in-netscaler-adc-and Source published Oct 8, 2026

VulniPulse record published Oct 8, 2026Record updated Oct 8, 2026

CVE-2026-107406

Affected products & platforms

NetScaler (Citrix)NetScaler Gateway

Open source advisory

Android app · Google Play

Monitor future NetScaler (Citrix) CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

Today, Citrix published a critical security bulletin for NetScaler ADC and NetScaler Gateway regarding CVE-2026-107406. CVE-2026-107406 is a memory overflow vulnerability that may lead to remote code execution or denial of service under specific configuration conditions.

The issue carries a CVSS v4.0 base score of 9.5 and is rated Critical. We strongly urge affected customers to review the advisory and upgrade impacted NetScaler instances to the recommended versions as soon as possible.

As of the publication of the bulletin, Citrix is not aware of any unmitigated exploits of this vulnerability.

Affected versions

NetScaler ADC and NetScaler Gateway before 14.1-73.37
NetScaler ADC 14.1-FIPS before 14.1-73.37
NetScaler ADC and NetScaler Gateway before 13.1-64.23

Official advisory · high-confidence parse· fetched 1 day ago·verify at source

Fixed versions

14.1-73.37
13.1-64.23

Official advisory · high-confidence parse· fetched 1 day ago·verify at source

Mitigation checklist

Recommended fix / mitigation

Upgrade to a fixed build: 14.1-73.37, 13.1-64.23 or later for your release line.

Official advisory · high-confidence parse· fetched 1 day ago·verify at source

Sources

Official and corroborating records used to build this advisory.

NetScaler / Cloud Software Group Security Bulletinsofficial
Official vendor source used to discover this advisory; it remains the authority for affected products and remediation. Discovered from the machine-readable feed https://community.citrix.com/rss/3-citrix-tech-zone-blogs.xml/; this link opens the NetScaler (Citrix) advisory index instead of the raw feed document.
NetScaler (Citrix)
Official vendor advisoryofficial
Official advisory page fetched and parsed; accepted detail fields are attributed to this page.
NetScaler (Citrix)
CVE.org CNA affected-product recordCVE.org
Structured CNA affected[] data independently confirmed the affected product scope; native advisory content remains authoritative.
CVE Program

Cross-references

Validate CVE metadata against the authoritative registries.

CVE-2026-107406NVD CVE.org MITRE

Official resources

NetScaler ADC / Gateway upgrade & downgrade guide (target: 14.1-xx.xx / 13.1-xx.xx)
Official documentation
This advisory names 14.1-xx.xx / 13.1-xx.xx as the first fixed releases — official upgrade documentation for NetScaler ADC / Gateway upgrade & downgrade guide.
NetScaler Firmware Downloads
Official documentation
Official download location for the fixed NetScaler ADC/Gateway builds.

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.