NetScaler SAML Memory Overflow Flaw Triggers RCE or DoS on Identity Providers and Service Providers

Citrix has addressed a severe security defect in its NetScaler ADC and NetScaler Gateway platforms. The vulnerability, tracked as CVE-2026-107406, allows attackers to execute code remotely or crash services through a memory overflow.

What happened

The issue stems from a memory overflow vulnerability within the SAML handling components of the software. According to the National Vulnerability Database, this defect can lead to remote code execution or denial-of-service conditions. SecurityWeek reports that Citrix is urging immediate patching for this critical vulnerability. The flaw is specific to deployments where NetScaler ADC or NetScaler Gateway is configured as either a SAML Service Provider (SP) or a SAML Identity Provider (IdP).

The range of affected versions is extensive. Systems running NetScaler ADC and Gateway before 14.1-73.37 and 13.1-64.23 are vulnerable if configured as SP or IdP. More recent versions, up to 14.1-73.41 and 13.1-64.28, are only affected if configured as a SAML IdP. FIPS-certified versions are similarly impacted across their respective release ranges. The Canadian Centre for Cyber Security issued advisory AV26-1023 on 9 October 2026, listing the affected versions and encouraging administrators to apply updates.

Why it matters

SAML is a widely used standard for single sign-on, meaning many organisations rely on NetScaler for secure access management. A remote code execution flaw in this component could allow an attacker to take full control of the gateway device. This could lead to data theft, pivoting into internal networks, or complete service disruption. With a CVSS score of 9.5, the potential impact is severe, particularly for high-availability environments where downtime is costly. The requirement for specific SAML configurations means not every installation is at risk, but the exposure remains significant for those using identity federation features.

Next steps

• Inventory all NetScaler ADC and Gateway instances to identify SAML configurations.
• Check version numbers against the affected ranges provided by Citrix.
• Prioritise patching for systems acting as SAML Identity Providers, as they are vulnerable across more version ranges.
• Monitor official channels for further guidance on mitigation if immediate patching is not possible.

What to do and how to stay safe: Citrix

• Verify the current configuration of all NetScaler devices to determine if SAML SP or IdP roles are active.
• Review network logs for unusual traffic patterns targeting SAML endpoints, which may indicate exploitation attempts.
• Ensure that access to management interfaces is restricted to authorised personnel only.
• Once the vendor provides an update, test the patch in a non-production environment before widespread deployment.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific versions of NetScaler are affected by CVE-2026-107406?

Versions before 14.1-73.46 and 13.1-64.29 for ADC and Gateway, and specific FIPS versions, are affected depending on SAML configuration.

Is the vulnerability exploitable without SAML configuration?

No, the flaw only applies when the system is configured as a SAML Service Provider or Identity Provider.

What is the severity of this vulnerability?

The National Vulnerability Database rates CVE-2026-107406 as Critical with a CVSS score of 9.5.