Affected Systems

Citrix NetScaler ADC and NetScaler Gateway appliances configured as SAML Identity Provider (IdP) or Service Provider (SP). Vulnerable versions: NetScaler ADC/Gateway 14.1 prior to 14.1-73.46, 13.1 prior to 13.1-64.29; NetScaler ADC 14.1-FIPS prior to 14.1-73.46 FIPS; NetScaler ADC 13.1-FIPS and 13.1-NDcPP prior to 13.1.37.283. Approximately 21,000 NetScaler instances exposed to the internet.

Exploitation Status

No active exploitation detected as of publication. Citrix states they are not aware of any unmitigated exploits. However, NetScaler appliances have a history of rapid exploitation following disclosure—two vulnerabilities disclosed in March 2026 were exploited within days, and four zero-days were actively exploited in September and October 2026.

Business Impact

Critical memory overflow vulnerability enables unauthenticated remote code execution or denial-of-service on NetScaler appliances configured with SAML. Given Citrix's track record (27 actively exploited vulnerabilities since 2021, including 7 used in ransomware), exploitation is highly likely once details emerge. NetScaler appliances are high-value targets providing access to internal networks, credentials, and remote access infrastructure. Organizations with SAML-configured NetScaler instances face immediate risk of compromise, lateral movement, and ransomware deployment.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately identify all NetScaler ADC and NetScaler Gateway appliances configured as SAML IdP or SP using configuration audits or Citrix ADM inventory tools
  • Upgrade vulnerable NetScaler instances to patched versions: 14.1-73.46+ for 14.1 branch, 13.1-64.29+ for 13.1 branch, 14.1-73.46 FIPS+ for FIPS builds, or 13.1.37.283+ for 13.1-FIPS/NDcPP
  • Monitor NetScaler appliance logs for unusual authentication attempts, memory errors, or unexpected process execution during and after patching window
  • If immediate patching is not feasible, disable SAML IdP/SP configuration temporarily or restrict network access to NetScaler management interfaces and SAML endpoints to trusted IP ranges only
  • Review CISA's Known Exploited Vulnerabilities catalog and verify all 27 previously flagged Citrix vulnerabilities are patched across the NetScaler fleet