NHS England escalated patching work on Citrix NetScaler appliances over the weekend, telling trusts that a critical SAML authentication flaw could let remote attackers execute code or knock services offline. Cyber alert CC-4865, published on 9 October, carries high severity and a required patch path for gateways configured for SAML single sign-on.
The bulletin tracks CVE-2026-107406, which Citrix addressed in fixed releases for current NetScaler ADC and Gateway branches. NHS England's national CSOC said it is likely the flaw will be exploited, citing recent experience where NetScaler vulnerabilities were mass-attacked within hours of public proof-of-concept code. Earlier alerts this year covered related remote code execution issues on the same product family.
Who is in scope
The alert targets organisations running NetScaler ADC or NetScaler Gateway with SAML authentication enabled — a common pattern for NHS staff accessing clinical systems through identity providers. Fixed versions include 14.1-73.46 and later on the 14.1 train and 13.1-64.29 and later on 13.1, with separate FIPS builds listed. Releases 12.1 and 13.0 are end of life and must be migrated before patching is even an option.
Trusts still on unsupported firmware face a harder project: hardware refresh or major version upgrades during a period when clinical networks are already juggling winter pressures. NHS Digital's reporting line and the national cybersecurity operations centre expect evidence of remediation, not just ticket creation.
National context
The NetScaler campaign lands as the National Cyber Security Centre publishes refreshed guidance on reducing disruptive attacks, aimed at leaders responsible for critical services. NCSC chief executive Richard Horne told audiences earlier this year that hostile states were linked to a large share of incidents affecting UK critical infrastructure. Health is a frequent target because of data value and legacy exposure on perimeter devices.
Vendor coordination matters. Citrix's security bulletin provides version numbers; NHS England translates that into operational language for IT teams who must schedule maintenance windows without interrupting patient flows. Where SAML is not in use, risk may be lower, but asset inventories in the NHS have historically missed dormant virtual IPs still listening on vulnerable builds.
What IT teams should do Monday
Security leads should confirm SAML use on each NetScaler instance, match build numbers against Citrix's fixed list and expedite change approvals. Where FIPS modes apply, use the FIPS-specific builds in the alert. Log monitoring for anomalous authentication traffic should continue after patching because exploitation may precede public disclosure.
CC-4865 is not abstract hygiene — it is a timed response to a flaw the NHS assesses as likely to be weaponised. For patients the stakes are service availability and record integrity; for administrators it is another weekend-turned-week of emergency change control on infrastructure that was supposed to be boring.