Citrix Product Security Update Advisory (CVE-2026-107406)

Overview

Citrix has released a security update addressing CVE-2026-107406, a memory overflow vulnerability affecting NetScaler ADC and NetScaler Gateway. This vulnerability could lead to remote code execution (an attack in which a threat actor executes arbitrary code remotely) or a denial of service (a condition that disrupts normal service delivery).

Affected Products

Products below the following versions are affected:

• NetScaler ADC and NetScaler Gateway versions prior to 13.1-64.29.
• NetScaler ADC and NetScaler Gateway versions prior to 14.1-73.42.
• NetScaler ADC FIPS versions prior to 14.1-73.42 FIPS.
• NetScaler ADC FIPS and NDcPP versions prior to 13.1-37.283.

Recommended Actions

Citrix has provided Vulnerability Patches for these vulnerabilities through the latest updates. Product users should update to the following versions or higher, following the instructions on the reference site.

• NetScaler ADC and NetScaler Gateway 13.1: 13.1-64.29 Or higher.
• NetScaler ADC and NetScaler Gateway 14.1: 14.1-73.46 Or later.
• NetScaler ADC FIPS 14.1: 14.1-73.46 FIPS or later.
• NetScaler ADC FIPS and NDcPP 13.1: 13.1-37.283 Or later.

Note

• Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-107406.