Post

A *new* SAML RCE for Citrix is out. The new vulnerability (CVE-2026-107406) is only applicable if you're running your NetScaler deployment as a SAML *Identity Provider*. If you’re using Citrix as a service provider & patched last weekend you’re ok. Surely the madness will stop someday. Right?

8/10/26, 9:23 pm0 reposts0 likes

Fran Donoso

@francisck.com

community.citrix.com/techzone-blo...

community.citrix.comProtecting Customers: Immediate Guidance for CVE-2026-107406 in NetScaler ADC and NetScaler GatewayToday, Citrix published a critical security bulletin for NetScaler ADC and NetScaler Gateway regarding CVE-2026-107406. CVE-2026-107406 is a memory overflow vulnerability that may lead to remote code ...