Citrix has released fixes for a new critical flaw in NetScaler ADC and NetScaler Gateway and is urging customers to update as soon as possible. This is separate from the NetScaler issues we reported earlier this month.

• What it is: A memory overflow flaw (CVE-2026-107406) that can allow an attacker to run their own code on the appliance or crash it.
• Who is affected: NetScaler ADC and Gateway appliances configured as a SAML Identity Provider or Service Provider.
• The risk: Citrix reports no known exploitation yet, but NetScaler flaws have been attacked quickly after disclosure. About 21,000 NetScaler devices are visible on the internet.
• What to do: Upgrade to 14.1-73.46 or later, or 13.1-64.29 or later (FIPS and NDcPP builds have their own fixed releases listed in the Citrix bulletin).

We recommend businesses running NetScaler schedule this update immediately, before attackers begin exploiting it.

Sources: BleepingComputer