1 (888) 897-3611 Book a call

Threat advisory · Multiple

Citrix NetScaler: a new critical flaw, and Canada's Cyber Centre updates its alert

Canada's Cyber Centre updated its Citrix NetScaler alert on Oct. 9, 2026 with a new critical SAML flaw. Patch to the latest build and check for compromise.

By happier IT 5 min read

On October 9, 2026, the Canadian Centre for Cyber Security updated its alert on Citrix NetScaler ADC and NetScaler Gateway to add a new critical flaw, CVE-2026-107406, affecting appliances that use SAML single sign-on. Organizations running NetScaler should upgrade to Citrix’s latest fixed builds and check for signs of earlier compromise.

What happened

Citrix published security bulletin CTX697191 on October 8, 2026. It describes CVE-2026-107406, a memory overflow in NetScaler ADC (application delivery controller) and NetScaler Gateway, the remote-access appliance many organizations use for VPN (virtual private network) and application logins. Citrix rates it critical, with a CVSS (Common Vulnerability Scoring System) v4.0 score of 9.5, and says it can lead to remote code execution or a denial of service.

The flaw only applies when the appliance is set up for SAML (Security Assertion Markup Language), the standard behind many single sign-on logins, either as a service provider or as an identity provider. Citrix’s bulletin does not say the flaw is being exploited, and BleepingComputer reported that Citrix is “not aware of any unmitigated exploits.”

The next day, the Cyber Centre published Update 2 to its alert AL26-024 and a companion advisory, AV26-1023. The alert states that earlier patches are not enough to fix this new issue.

This builds on a more serious situation from last month. On September 27, 2026, Citrix released fixes for two other NetScaler flaws, CVE-2026-88771 and CVE-2026-88772, and confirmed that attackers had exploited them on unpatched appliances. The US Cybersecurity and Infrastructure Security Agency (CISA) added both to its Known Exploited Vulnerabilities catalogue the same day, Help Net Security reported. The Hacker News later reported that security firm LevelBlue found attackers using a script on compromised appliances that adds a hidden administrator account called “sec_monitor” and installs a web shell disguised as ordinary NetScaler web files.

What is not yet known: whether CVE-2026-107406 will be exploited, and how many Canadian organizations were affected by the September attacks. The Cyber Centre’s alert makes no statement about exploitation in Canada.

Who is affected

Any organization running customer-managed NetScaler ADC or NetScaler Gateway appliances, including Secure Private Access hybrid deployments that use NetScaler. For the new flaw specifically, only appliances configured as a SAML service provider or identity provider are affected. Citrix-managed cloud services are being updated by Citrix directly.

BleepingComputer, citing the Shadowserver Foundation, reported more than 21,000 internet-exposed NetScaler instances worldwide, though it is not known how many are already patched.

What to do now

If you run NetScaler, or an IT provider runs it for you:

  1. Check for SAML. Citrix says to search the configuration for add authentication samlAction or add authentication samlIdPProfile.
  2. Upgrade. Citrix’s fixed builds are NetScaler ADC and Gateway 14.1-73.46 or later, 13.1-64.29 or later, 14.1-73.46 FIPS or later, and 13.1-FIPS / 13.1-NDcPP 13.1.37.283 or later.
  3. Preserve evidence before you change anything. The Cyber Centre recommends keeping appliance logs, remote syslog records, NetScaler Console logs and support bundles.
  4. Look for signs of the September attacks. Run Citrix’s NetScaler Console indicators-of-compromise (IOC) tool, check for unexpected administrator accounts, and compare findings with firewall, DNS and login logs. The Cyber Centre warns that patching may not remove an attacker who already has a foothold.
  5. If you find anything, reset credentials, end active sessions, replace certificates, and be ready to rebuild the appliance from a known-good configuration. Report it to the Cyber Centre through My Cyber Portal or [email protected].

If you don’t know whether your organization uses NetScaler, ask whoever manages your remote access. It’s a quick question with a clear answer.

What this means for organizations in BC and Alberta

A compromised remote-access appliance can expose the personal information that passes through it, so this can become a privacy question as well as a technical one.

  • Federally (PIPEDA): organizations covered by the Personal Information Protection and Electronic Documents Act must report a breach of security safeguards to the Office of the Privacy Commissioner of Canada, and notify affected people, when it creates a real risk of significant harm. They must keep a record of every such breach for at least two years.
  • Alberta (PIPA): under section 34.1 of the Personal Information Protection Act, an organization must notify Alberta’s Information and Privacy Commissioner without unreasonable delay when a reasonable person would consider there is a real risk of significant harm.
  • British Columbia: BC’s private-sector Personal Information Protection Act does not currently require breach reporting, but the Office of the Information and Privacy Commissioner for BC strongly recommends it as best practice. Public bodies under BC’s Freedom of Information and Protection of Privacy Act (FIPPA) must report breaches likely to cause significant harm.

For organizations across British Columbia and Alberta, the practical step is the same: patch, check, and keep a written record of what you found.

How happier IT helps

Keeping edge devices like NetScaler current is part of our patch management service, and our managed security services team watches for the signs of compromise described above. If you think something got in, our incident response team can help you investigate calmly and preserve what matters. Not sure where you stand? Start with a free IT assessment.

Sources

Common questions

Do I need to patch Citrix NetScaler again if I already patched in September?
Yes, if your appliance uses SAML single sign-on. The Canadian Centre for Cyber Security says the September updates do not fix CVE-2026-107406. Citrix's fixed builds are 14.1-73.46 and 13.1-64.29 or later.
Is CVE-2026-107406 being exploited?
Not as far as anyone has said publicly. Citrix said it was not aware of exploitation when it published the fix on October 8, 2026. The two NetScaler flaws Citrix fixed on September 27, 2026 were exploited, and the Cyber Centre says patching alone may not remove an attacker who already got in.
How do I know if my NetScaler uses SAML?
Citrix says to look in the appliance configuration for "add authentication samlAction" (SAML service provider) or "add authentication samlIdPProfile" (SAML identity provider). If either is there, the new flaw applies to you.

More from the feed

Other incidents we've written up.

Want to know what this would look like for you?

A 30-minute call. No slides, no audit fee, no obligation. We ask what is breaking and tell you honestly whether we are the right fit.

Book a 30-minute call Get a free IT assessment

Or call 1 (888) 897-3611