The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has folded a newly disclosed critical flaw in Citrix NetScaler appliances into the alert it has used since Sept. 27 to press organizations to patch actively exploited zero-days in the same products, Cybersecurity Dive reported. The change means organizations that have already rushed through NetScaler upgrades in recent weeks face another one if their devices handle SAML logins, and CISA wants them to look for signs of intrusion before they patch.

The flaw, CVE-2026-107406, is the SAML memory bug Citrix disclosed last week. Unlike the three zero-days already in the alert, it has no publicly reported attacks. CISA has not added it to its Known Exploited Vulnerabilities (KEV) catalog, the agency's list of flaws confirmed to be under attack, and Citrix said, according to BleepingComputer, that it "is not aware of any unmitigated exploits of this vulnerability."

What Happened

CISA last revised its alert, "Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway," on Oct. 9. NetScaler ADC and NetScaler Gateway are appliances that many companies place at the edge of their networks to balance traffic and handle remote access and logins. The revision added CVE-2026-107406 and CVE-2026-88779, bringing the alert to 10 vulnerabilities, and stressed prompt patching of all of them.

RelatedCISA Orders Agencies to Fix Exploited Palo Alto Firewall and Cisco Email Gateway Flaws by Saturday

According to the CVE record NetScaler published Oct. 8, the new bug is a memory overflow that can lead to remote code execution, meaning an attacker could run commands of their choosing on the device, or to a denial of service that knocks it offline. It applies only to appliances configured as a SAML identity provider or service provider, the roles a device plays when it vouches for users in single sign-on. On builds 14.1-73.37 through 14.1-73.41 and 13.1-64.23 through 13.1-64.28, only the identity-provider role is exposed. The record scores the flaw 9.5 out of 10 under version 4 of the Common Vulnerability Scoring System. Fixes are in 14.1-73.46 and 13.1-64.29, with separate builds for FIPS and NDcPP deployments that follow government security certifications.

The revision also clarified how two of the exploited zero-days may fit together. On SAML-configured appliances, CVE-2026-88779 can crash the device on its own. On unpatched devices, attackers may use it to force a reboot that helps run code they planted earlier through CVE-2026-88771. CISA presents that chain as possible, not confirmed. CVE-2026-88771 and CVE-2026-88772 entered the KEV catalog Sept. 27, and CVE-2026-88779 followed Oct. 4.

Why It Matters

CISA's guidance goes beyond installing updates. The agency asks organizations to check for indicators of compromise before patching, preserve forensic evidence because updating may erase traces, and forward NetScaler logs to a central monitoring system because local logs rotate quickly. If compromise is suspected, it advises restoring a clean backup from before the intrusion and rotating every restored secret, including local passwords, key-encryption keys and SSL certificates.

For executives, that turns a routine patch into an incident-response exercise with downtime, staff hours and possibly certificate reissuance. The installed base is large: BleepingComputer, citing the Shadowserver Foundation, counted more than 21,000 internet-exposed IP addresses with NetScaler fingerprints, while noting it is unknown how many are already patched or configured in a vulnerable way. Cybersecurity Dive reported that Google Threat Intelligence Group found dozens of organizations affected by the earlier zero-days and that several hospitals disconnected systems after Dutch authorities flagged exploitation.

CISA's own assessment, added to the CVE record Oct. 9, rates the new flaw's technical impact as "total" but records no exploitation and judges it not automatable. Rapid7 researcher Stephen Fewer told Cybersecurity Dive that, as a memory corruption bug, it is less likely than CVE-2026-88771 to be exploited broadly.

Context

NetScaler is a repeat target. BleepingComputer notes that CISA has listed 27 exploited Citrix vulnerabilities in the KEV catalog since November 2021, seven of them used in ransomware attacks. Our earlier coverage traced the first two zero-days, Mandiant's findings on the intrusions and the third exploited flaw.

What to Watch

  • Whether exploitation of CVE-2026-107406 is reported and CISA adds it to the KEV catalog, which would come with a remediation deadline for federal agencies.
  • How quickly the exposed NetScaler population shrinks in Shadowserver's internet scans.
  • Further revisions to CISA's alert, which has been updated twice since it was first issued Sept. 27.