A Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway Could Allow for Remote Code Execution

A vulnerability has been discovered in Citrix NetScaler Application Delivery Controller (ADC) and Citrix NetScaler Gateway that could allow for remote code execution. Citrix NetScaler ADC (Application Delivery Controller) is an enterprise networking platform and traffic management device designed to optimize, secure, and accelerate the delivery of web and cloud applications. Successful exploitation of the most severe of these vulnerabilities could allow attackers to gain remote code execution (RCE) on targeted devices or trigger a denial-of-service state that can cause crashes. To be vulnerable, NetScaler ADC and NetScaler Gateway appliances must be configured as a Security Assertion Markup Language (SAML) Identity Provider (IdP) or Service Provider (SP).

There are currently no reports of the vulnerability for CVE-2026-107406 being exploited in the wild.

However, these security appliances are being actively targeted and exploited as part of an ongoing pattern of threat activity leveraging Citrix vulnerabilities. Four CVEs have been added to CISA’s KEV catalog over the last few weeks. Several of these flaws were exploited as zero-days before patching guidance was released. Reporting indicates initial exploitation is resulting in web shell deployment, persistence activity, and lateral movement within impacted networks. Following CVE disclosures, additional exploitation has been reported in under 36 hours and it is assessed that exploit chaining is occurring across some of these vulnerabilities. Related Citrix NetScaler CVEs under active exploitation include CVE-2026-19490, CVE-2026-88771, CVE-2026-88779, and CVE-2026-88772.

A vulnerability has been discovered in Citrix NetScaler Application Delivery Controller (ADC) and Citrix NetScaler Gateway that could allow for remote code execution. Details of the vulnerability are as follows:

Tactic:Initial Access(TA0001):

Technique:Exploit Public-Facing Application(T1190):

Successful exploitation of the most severe of these vulnerabilities could allow attackers to gain remote code execution (RCE) on targeted devices or trigger a denial-of-service state that can cause crashes. To be vulnerable, NetScaler ADC and NetScaler Gateway appliances must be configured as a Security Assertion Markup Language (SAML) Identity Provider (IdP) or Service Provider (SP).

We recommend the following actions be taken:

Copyright©2026 Center for Internet Security®