Today’s Field Note

Citrix dropped patches for two separate critical NetScaler ADC and Gateway flaws, including CVE-2026-107406, a memory overflow enabling RCE or DoS in SAML-configured deployments, and is urging admins to patch immediately. These appliances are a recurring doorway into exchange back-ends, custody ops, and treasury infrastructure, and NetScaler bugs have a long history of being exploited before most shops finish patching. Separately, Searchlight Cyber disclosed a GoBalance flaw (October 8) that lets anyone derive the secret key controlling a site’s .onion address from public data alone, then hijack traffic to a cloned site. If you run any Tor-reachable service for OTC, mixing-adjacent, or privacy ops, your onion identity is now forgeable. Neither is theoretical, and NetScaler is already the kind of flaw attackers weaponize within days.

Today’s Move

  • Patch NetScaler ADC and Gateway now for CVE-2026-107406 (and the second Citrix-flagged RCE); prioritize any box fronting exchange, custody, or treasury systems.
  • Audit NetScaler SAML configurations specifically, since that is the exploit condition, and review logs for anomalous sessions since patch release.
  • If you operate GoBalance for .onion load balancing, rotate your onion service keys and regenerate addresses, treating existing ones as compromised.
  • Verify .onion addresses you depend on out-of-band before trusting them, since cloned-site redirection is the attack.
  • Assume both are being scanned for today; pull external exposure of any unpatched NetScaler off the public internet until patched.

Resources

  • https://www.bleepingcomputer.com/news/security/citrix-warns-admins-to-patch-new-netscaler-rce-flaw-immediately/
  • https://thehackernews.com/2026/10/citrix-patches-critical-netscaler-flaw.html
  • https://thehackernews.com/2026/10/gobalance-flaw-lets-attackers-hijack.html
  • Incident trackers (reference standard): Rekt leaderboard · SlowMist Hacked

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @ItsAlreadyPrice or subscribe via RSS.