Citrix fixes critical NetScaler ADC and Gateway vulnerability enabling remote code execution

Citrix fixed CVE-2026-107406, a critical memory overflow vulnerability affecting NetScaler ADC and NetScaler Gateway. Under certain configuration conditions, it could allow remote code execution or denial-of-service attacks. Citrix said that, at the time of publication, it was not aware of any unmitigated exploitation or attacks in the wild involving this vulnerability.