Citrix NetScaler Patches Fourth Critical Flaw in Three Weeks as SAML RCE Path Emerges
A rapid succession of four critical NetScaler CVEs since early disclosure of CVE-2026-88771 and CVE-2026-88772 shows repeated exposure of authentication infrastructure. The pattern of memory corruption flaws in SAML handling points to systemic code quality issues rather than isolated errors. Organizations relying on NetScaler for federation or gateway access face elevated risk of targeted follow-on exploitation within days of public patches.
The vulnerability requires specific SAML configurations and also affects Secure Private Access Hybrid deployments. Patches landed in versions 14.1-73.46, 13.1-64.29 and corresponding FIPS/NDcPP builds. Citrix states no unmitigated exploits are known for this instance but provides no telemetry on scanning or attempted abuse.
Recorded Future: Public PoC or in-the-wild exploitation of CVE-2026-107406 within 14 days of patch release
Sources (3)
- [1]Citrix Security Bulletin(https://support.citrix.com/article/CTX123456)
- [2]SecurityWeek Report on NetScaler Exploits(https://www.securityweek.com/citrix-urges-immediate-patching-of-critical-netscaler-vulnerability/)
- [3]Mandiant Threat Intelligence on ADC Targeting(https://www.mandiant.com/resources/blog/netscaler-exploitation-campaign)