Citrix Warns of Critical NetScaler Flaw That Could Let Attackers Execute Code Remotely

Citrix Systems has issued an advisory about a newly discovered memory‑overflow bug affecting its NetScaler ADC and NetScaler Gateway products, a flaw that security researchers say could give an unauthenticated attacker the ability to run arbitrary code or cause a denial‑of‑service condition under certain deployment settings.

The vulnerability, catalogued as CVE‑2026‑107406, has been assigned a base score of 9.5 on the CVSS v4.0 scale, placing it in the critical severity tier. According to the advisory, the issue stems from unchecked input handling in the devices' processing of network traffic, which can corrupt memory and open a pathway for malicious payloads.

Citrix disclosed the problem after it was initially reported by the security community group GBHackers. The researchers highlighted that exploitation requires specific configurations—namely, instances where the NetScaler ADC or Gateway is exposed to untrusted networks without additional hardening. Nonetheless, many enterprises run these appliances at the edge of their infrastructure, making the attack surface potentially large.

In response, Citrix has released software updates that remediate the overflow condition and has urged all customers to apply the patches as soon as possible. The company also recommends reviewing deployment architectures, disabling unnecessary services, and enabling any available mitigations such as address space layout randomization (ASLR) and strict input validation wherever feasible.

Industry analysts note that the flaw arrives at a time when remote‑work and cloud‑based applications continue to drive heavy reliance on application delivery controllers. A successful exploit could allow threat actors to bypass network segmentation, exfiltrate data, or disrupt critical services, underscoring the urgency of the patch rollout.

Citrix has not disclosed any confirmed incidents linked to the vulnerability, but the advisory emphasizes that the risk is real and that attackers often scan for unpatched NetScaler deployments. Organizations are advised to verify their inventory, confirm that the latest firmware is installed, and monitor for any anomalous traffic that might indicate probing attempts. The swift release of a fix and the public disclosure aim to give defenders a chance to shore up defenses before the vulnerability is weaponized at scale.