CVE-2026-107406: NetScaler ADC and Gateway SAML overflow

Call: Patch now if your NetScaler does SAML, as either the service provider or the IdP. CVE-2026-107406 is a memory overflow that leads to remote code execution or denial of service. Citrix scores it 9.5 (CVSS 4.0).

Is it exploited? Not as far as anyone has said. Citrix says it isn’t aware of unmitigated exploits, and CIS has no reports of exploitation. But its siblings are. CISA’s NetScaler alert covers CVE-2026-88771 and CVE-2026-88772, which were exploited as zero-days and added to KEV on September 27, and CVE-2026-88779, added to KEV on October 4. CISA updated that alert on October 9 to include this one. If you patched for the September bugs and stopped there, you’re still exposed to this one. NetScaler bugs don’t tend to stay unexploited for long.

What breaks: The appliance, if someone sends it the right SAML traffic: code execution or a crash.

Who’s hit: Customer-managed NetScaler ADC and Gateway configured as a SAML SP or IdP. Secure Private Access hybrid deployments count too.

Before 14.1-73.37 or 13.1-64.23: affected as SP or IdP.
14.1-73.37 to 14.1-73.41, and 13.1-64.23 to 13.1-64.28: affected as IdP only.

To check, look in ns.conf for add authentication samlAction (SP) or add authentication samlIdPProfile (IdP). If neither is there, this one isn’t yours.

Fix:

14.1-73.46 or later
13.1-64.29 or later
14.1-73.46 FIPS
13.1-37.283 FIPS and NDcPP

Workaround: There isn’t one in the bulletin. Upgrade.

Sources: Citrix CTX697191 (opens in a new tab), CISA alert (opens in a new tab), CIS advisory 2026-110 (opens in a new tab).

CVE-2026-107406: NetScaler ADC and Gateway SAML overflow

Sources

More from September 2026 patch cycle