The Australian Signals Directorate’s Australian Cyber Security Centre has updated its recent Citrix alert to include a newly discovered vulnerability in the company’s NetScaler ADC and NetScaler Gateway devices.
“A further critical vulnerability (CVE-2026-107406) impacting Citrix NetScaler ADC and Citrix NetScaler Gateway configured as SAML SP or IdP has been discovered,” the ACSC said in an update published late last week.
“CVE-2026-107406 is a memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service.”
More worryingly, the company's most recent patches, which addressed a raft of prior vulnerabilities, do not address this latest issue, meaning another round of updates will be necessary to secure Citrix devices.
The versions impacted by the new vulnerability differ between SAML SP or SAML IdP configurations. The versions below have been patched to address CVE-2026-107406:
- Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1-73.46 and later releases
- Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1-64.29 and later releases of 13.1
- Citrix NetScaler ADC 14.1-FIPS 14.1-73.46 FIPS and later releases of 14.1-FIPS
- Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.283 and later releases of 13.1-FIPS and 13.1-NDcPP
The United States Cybersecurity & Infrastructure Security Agency has also added CVE-2026-107406 to its most recent Known Exploited Vulnerabilities alert.
The ACSC initially warned of the most recent crop of NetScaler vulnerabilities in late September, and urged Australian organisations to “take the appliances offline immediately”. A week later, the agency said it had become aware of hacking campaigns actively targeting Australian entities.
For now, the ACSC is encouraging Australian organisations to review Citrix’s latest advisory and patch appropriately.
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
