decrypted · 12 october 2026 · vulnerabilities and patching · uk policy and law · ai and llm security

Citrix NetScaler's next critical SAML flaw lands on top of last week's patches

Citrix's NetScaler appliances have another critical flaw, and this one lands on top of last week's fixes. CVE-2026-107406 was disclosed on 8 October. NHS England's cyber alert, last edited today, says its National CSOC assesses it is likely to be exploited. Citrix says that as of publication it knew of no unmitigated exploits. That describes a bulletin, not next week.

What the flaw is

Citrix describes a memory overflow that can lead to remote code execution or a denial of service, scored 9.5 under CVSS v4.0. It bites only when the appliance is configured as a SAML service provider or identity provider, which is how many organisations run single sign-on. Think of SAML as a receptionist who checks visitor passes issued by a trusted office. The overflow is a pass so crammed with writing that it spills across the desk and rewrites the receptionist's instructions. Fixed builds are 14.1-73.46 and 13.1-64.29 or later, plus FIPS equivalents. Citrix lists no workaround. To check exposure, look for add authentication samlAction or add authentication samlIdPProfile in the configuration.

Why the timing hurts

Earlier this month Citrix also dealt with CVE-2026-88779, a denial-of-service zero-day that researchers and admins said could also enable remote code execution. Fixes for the September flaws shipped in builds such as 14.1-73.37 and 13.1-64.23. Under Citrix's new bulletin, builds from 14.1-73.37 to 14.1-73.41 and 13.1-64.23 to 13.1-64.28 remain affected when set up as an identity provider. So an administrator who patched dutifully last week may be exposed again, and the NCSC's weekly summary for the week ending 4 October already recorded NetScaler exploitation. BleepingComputer, citing CISA, counts 27 exploited Citrix flaws since November 2021, seven used in ransomware attacks. NHS England adds that end-of-life 12.1 and 13.0 appliances are likely vulnerable and should be migrated.

How exposed you are

Shadowserver counts over 21,000 internet-facing addresses with NetScaler fingerprints, though BleepingComputer notes that says nothing about how many are patched, honeypots or SAML-configured. I could not confirm working public exploit code, so the "likely" in NHS England's assessment is a forecast, not an observation. Its warning is that researchers have seen mass exploitation of recent NetScaler flaws within hours of public proof-of-concept code appearing. If you suspect compromise, preserve evidence before patching.

The Secure by Design lesson

The NCSC's Ollie Whitehouse wrote that this exploitation "again underlines why all vendors must now implement" the NCSC guidance on forensics and protective monitoring for network devices. That is the vendor half. Memory overflow in an internet-facing parser is the bug class Secure by Design exists to retire, and a customer cannot fix it, only choose suppliers who are.

The customer half is cheaper than it sounds:

Decide who may take a login box offline for an emergency patch, and give them authority to do it within a day, not at the next change window.
Ask your supplier to show where its appliance logs, and what it can tell you after a compromise.
Keep one appliance doing one job where you can. A single box that handles VPN, load balancing and login concentrates risk in one place.
Retire unsupported builds now, because nobody will patch them for you.

Also this week

One prompt, one AWS account of agents. Zenity Labs published research on Amazon Bedrock AgentCore on 8 October, which it calls AgentCorruption. A public-facing agent with a web request tool was asked, in plain language, to fetch data from the instance metadata service, and it returned the credentials of its own execution role. Zenity says that role reached other agents in the same account and region, including private conversations and stored third-party credentials, and that planted memory made the access persistent. AWS says the research "inaccurately paints expected and documented behavior as a vulnerability". It says newly deployed agents have launched with IMDSv2 only since 14 February, and Zenity reports the default role was narrowed by 29 September. No CVE was assigned. The lesson is old: an agent is a service account that takes instructions from strangers, so give it one job's permissions, not the account's.

The Cyber Security and Resilience Bill waits on the Lords. One regulatory tracker says Lords committee stage finished on 9 September, report stage has no date, and Royal Assent is expected between late 2026 and spring 2027. I found that in a single tracker and it is commentary, not a statutory timetable, so treat it as a guide. The tracker says the Bill will push critical digital infrastructure and managed services towards domestic reporting duties. A fair test for any director this week: if a NetScaler flaw were exploited on your estate tomorrow, could you say what happened, and to whom, within the day?

Sources

Want a second pair of eyes on your edge devices and incident reporting? get in touch.