NetScaler vulnerability fixed in SAML configurations

NetScaler vulnerability CVE-2026-107406 has been patched by Citrix after the company warned that affected NetScaler ADC and NetScaler Gateway deployments could face remote code execution or denial-of-service in specific SAML configurations.

Citrix describes CVE-2026-107406 as a memory overflow vulnerability. In plain terms, a memory overflow happens when software handles data in a way that can spill beyond the space it should use, which can sometimes let an attacker crash the service or run code. The flaw has a CVSS score of 9.5 out of 10.0, placing it in the critical range. Citrix says there is no evidence that this issue has been exploited in the wild.

The risk is tied to SAML, or Security Assertion Markup Language, a common single sign-on technology that lets users log in through an identity system rather than a separate password for every service. Citrix says exploitation depends on whether NetScaler is configured as a SAML identity provider, also called an IdP, or a SAML service provider, also called an SP. An IdP is the system that confirms who a user is, while an SP is the application or service that relies on that confirmation.

Administrators can check whether their NetScaler deployment matches the affected configuration by looking for SAML-related configuration entries. Citrix lists add authentication samlAction as an indicator for SAML SP configuration and add authentication samlIdPProfile as an indicator for SAML IdP configuration. For website owners and businesses, the practical point is that this is not a general desktop issue. It affects infrastructure used to manage access, application delivery and gateway functions, which often sit in front of business systems and web services.

The affected version ranges depend on how the NetScaler instance is configured. When configured as a SAML IdP, affected versions include NetScaler ADC and NetScaler Gateway from 14.1-73.37 through 14.1-73.41 inclusive, NetScaler ADC 14.1-FIPS from 14.1-73.37 FIPS through 14.1-73.41 FIPS inclusive, NetScaler ADC and NetScaler Gateway from 13.1-64.23 through 13.1-64.28 inclusive, and NetScaler ADC 13.1-FIPS from 13.1-NDcPP 13.1-37.279 through 13.1- 37.282 inclusive.

Citrix also lists broader affected ranges when NetScaler is configured as either a SAML SP or a SAML IdP. Those include NetScaler ADC and NetScaler Gateway before 14.1-73.37, NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS, NetScaler ADC and NetScaler Gateway before 13.1-64.23, and NetScaler ADC 13.1-FIPS before 13.1-NDcPP 13.1-37.279. Citrix further warns that Secure Private Access Hybrid deployments using NetScaler instances are affected and should be upgraded to recommended NetScaler versions.

The fixed versions are Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1-73.46 and later releases, Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1-64.29 and later releases of 13.1, Citrix NetScaler ADC 14.1-FIPS 14.1-73.46 FIPS and later releases of 14.1-FIPS, and Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.283 and later releases of 13.1-FIPS and 13.1-NDcPP.

For IT teams, the immediate task is to identify whether NetScaler is present, whether SAML is enabled in one of the affected roles, and whether the installed version falls inside the vulnerable ranges. Because the possible outcomes include remote code execution, meaning an attacker could run commands on a vulnerable system, and denial-of-service, meaning the service could be made unavailable, this update should be treated as a priority for any deployment that matches Citrix's conditions.

Citrix credited the JPMorgan Chase XOR Team and another reporter for discovering and reporting the flaw. The company also notes that three other NetScaler ADC and NetScaler Gateway flaws, CVE 2026-88771, CVE 2026-88772 and CVE 2026-88779, have been under active exploitation in the wild. Citrix does not state that CVE-2026-107406 is being exploited.

For organisations reviewing exposed infrastructure, AEU-I provides security-first IT, infrastructure and consulting, which is relevant to the kind of appliance configuration and upgrade planning this issue requires.

Website owners who rely on an IT provider or hosting partner should ask whether NetScaler ADC or NetScaler Gateway is used anywhere in front of their sites, login systems or business applications. If it is, the important follow-up is not just whether a patch exists, but whether the affected SAML configuration is present and whether the deployment has been upgraded to one of the fixed releases.