Vulnerabilities
Citrix NetScaler RCE Vulnerability (CVE‑2026‑107406) Requires Immediate Patch
Citrix has disclosed a critical memory‑overflow flaw in NetScaler ADC and Gateway appliances that can be leveraged for remote code execution or denial‑of‑service when configured as a SAML IdP or SP. Affected systems must be upgraded to the latest patched releases without delay. No active exploits reported yet, but defenders should verify patch status and monitor traffic.
What happened
Citrix disclosed a critical memory‑overflow flaw (CVE‑2026‑107406) in NetScaler ADC and Gateway appliances that can be exploited for remote code execution or denial‑of‑service.
Impact
Attackers can execute arbitrary code or crash the device when the appliance is configured as a SAML Identity Provider or Service Provider.
Affected Configurations
Only NetScaler ADC and Gateway devices running SAML IdP or SP roles are vulnerable.
Mitigation
Upgrade to the following patched releases:
- NetScaler ADC & Gateway 14.1‑73.46 and later
- NetScaler ADC & Gateway 13.1‑64.29 and later
- NetScaler ADC 14.1‑FIPS 14.1‑73.46 and later
- NetScaler ADC 13.1‑FIPS and 13.1
Citrix states no active exploits are known, but urges immediate patching.
Next Steps for Defenders
Verify patch status on all SAML‑enabled NetScaler devices, monitor for anomalous traffic, and apply the recommended updates as soon as possible.
Related vulnerabilities
Citrix Releases Patch for CVE-2026-107406: Critical NetScaler Memory Overflow Enabling RCE in SAML Deployments
Citrix has issued security updates for NetScaler ADC and Gateway to fix CVE-2026-107406, a 9.5‑score memory overflow that can lead to remote code execution or denial‑of‑service when the appliance is configured as a SAML IdP or SP. All affected versions must be upgraded to 14.1‑73.46 or later, or 13.1‑64.29 or later, and Secure Private Access deployments should be reviewed.
Read briefing
Kemp LoadMaster Uninitialized Memory RCE - CVE-2026-8037
Progress Software’s Kemp LoadMaster is vulnerable to a remote code execution flaw in the escape_quotes function. The issue requires authentication and allows attackers to run code as root. Apply the vendor patch immediately and verify configuration hardening.
Read briefing
Windows Overlay Filter RCE Vulnerability (CVE‑2026‑69959) – Immediate Patch Required
Microsoft has disclosed a high‑severity out‑of‑bounds read in the Windows Overlay Filter that allows an authorized user to execute arbitrary code locally. The flaw is fixed in the latest security update; administrators must apply the patch and verify system integrity.
Read briefing
CISA Adds CVE‑2026‑88779 to Known Exploited Vulnerabilities Catalog
CISA has added CVE‑2026‑88779, a Citrix NetScaler memory‑buffer overflow that allows attackers to gain full control of exposed assets, to its KEV catalog. Federal agencies must prioritize patching this high‑risk flaw per BOD 26‑04, while all organizations are encouraged to follow the same risk‑based approach. Defenders should verify patch status, monitor for exploitation indicators, and consider submitting unlisted KEVs.
Read briefing