Security advisory
Citrix NetScaler ADC & Gateway CVE-2026-107406: Critical Remote Code Execution and Denial-of-Service Risk
Organizations using Citrix NetScaler should review the affected systems and move to a vendor-designated fixed version.
9.5
Critical
CVE
CVE-2026-107406
Affected product
Citrix NetScaler
Potential impact
Remote code execution or denial of service
Date added
October 8, 2026
Recommended action
Update to a fixed version
Weakness
Memory-buffer bounds restriction
A critical vulnerability identified as CVE-2026-107406 affects Citrix NetScaler. The advisory information reviewed by Cornerstone.IT assigns the issue a CVSS score of 9.5 and describes potential remote code execution or denial-of-service conditions.
What we know
Why this advisory requires attention
The reported weakness is an improper restriction of operations within the bounds of a memory buffer. The advisory describes the issue as a memory-overflow vulnerability that could lead to remote code execution or denial of service.
Recommended response: Review the Citrix security bulletin, identify affected NetScaler systems, and update them to a vendor-designated fixed version.
Recommended actions
What organizations should do now
- Identify Citrix NetScaler deployments in the environment.
- Review the Citrix bulletin for affected versions and fixed releases.
- Plan and apply the vendor-recommended update.
- Confirm normal operation after the update is completed.
Organizations should use the Citrix bulletin as the source of truth for product-specific remediation details. The internal advisory did not specify a due date.
For law firms
Keep the response focused and controlled
For law firms using Citrix NetScaler, the immediate priority is to determine whether affected systems are present, understand the applicable fixed version, and complete the update through the firm’s normal change process.
Need assistance?
Cornerstone.IT can help review the advisory and plan the update.
Our team supports law firms with security updates and infrastructure changes while accounting for the systems attorneys and staff rely on.