The Australian Cyber Security Centre (ACSC) has issued an updated critical alert warning Australian organisations running Citrix NetScaler ADC and Citrix NetScaler Gateway to apply the latest vendor patches after a newly disclosed vulnerability was found to affect some SAML deployments.
In an update dated 9 October 2026, the ACSC said a further critical vulnerability, tracked as CVE-2026-107406, affects NetScaler ADC and NetScaler Gateway systems configured as a SAML service provider (SP) or identity provider (IdP). The agency described the issue as a memory overflow that could lead to remote code execution and/or denial of service, and said earlier patches for previously listed vulnerabilities do not address the latest flaw.
The ACSC advised organisations to review Citrix’s security advisory and apply updated patches.
The 9 October update follows earlier ACSC updates on 3 October and 30 September relating to separate NetScaler security issues and exploitation activity. On 3 October, the ACSC noted Citrix had published guidance for a “newly identified issue” affecting NetScaler deployments using SAML authentication, warning that a remote attacker could induce crashes, denial of service and potential exploitation. The ACSC said it was aware of impacts to Australian organisations and recommended users review configurations, monitor for unusual activity, and follow Citrix guidance. It also encouraged affected organisations to contact Citrix support and report to the ACSC.
On 30 September, the ACSC said it had received reports from Australian organisations confirming exploitation of vulnerabilities it had first alerted on 28 September 2026, and recommended organisations review for evidence of compromise dating back to at least 4 September 2026. The alert said Citrix had made indicators of compromise available through NetScaler Console and issued additional vendor guidance.
In background information included with the alert, the ACSC said Citrix had released eight vulnerabilities affecting NetScaler ADC and NetScaler Gateway, and that at least two of them (CVE-2026-88771 and CVE-2026-88772) had been under active exploitation globally before a patch was available. At the time of that section of the alert, the ACSC said it had not received reports of confirmed exploitation in Australia for those two CVEs.
The ACSC described CVE-2026-88771 as a remote code execution vulnerability that could allow an unauthenticated attacker to execute arbitrary commands, stating that all configurations of NetScaler ADC and NetScaler Gateway were affected. It said the remaining vulnerabilities require specific configurations for exploitation, and that Citrix had provided instructions for customers to check their exposure.
As mitigation, the ACSC recommended organisations review Citrix’s published vulnerability details and install security updates, consider internal security assessments and business priorities when scheduling patching, verify whether any preconditions applied to their deployments, and review device logs for suspicious activity.
Organisations seeking assistance were directed to contact the ACSC via 1300 CYBER1 (1300 292 371) and to report cybercrime via ReportCyber.
