Citrix Patches Critical NetScaler RCE Flaw Affecting SAML-Configured Appliances
Summary
Citrix disclosed CVE-2026-107406, a critical memory overflow in NetScaler ADC and Gateway that could enable unauthenticated code execution or denial of service on affected SAML-configured appliances. It recommends upgrading to patched builds.
Key points
- Citrix rates the flaw CVSS 4.0 at 9.5. It may allow unauthenticated remote code execution or denial of service; exploitation has high attack complexity.
- Exposure depends on both the appliance build and SAML role. Certain supported builds are vulnerable when configured as a SAML IdP; older supported builds may also be vulnerable as a SAML SP.
- Citrix recommends upgrading NetScaler ADC and Gateway 14.1 to 14.1-73.46 or later, and 13.1 to 13.1-64.29 or later. Separate fixed builds apply to FIPS and NDcPP deployments.
- Secure Private Access Hybrid deployments using affected NetScaler instances also require upgrades. Citrix-managed cloud services are updated by the provider.
- Citrix said at disclosure that it was unaware of unmitigated exploits. The article reports no publicly available PoC or confirmed exploitation campaign.
- Administrators should check appliance versions and SAML configuration, prioritize internet-facing systems, and investigate suspicious crashes or abnormal activity.
Article Details
- Vulnerability Types
- Memory overflow
- Severity
- Critical (CVSS v4.0: 9.5)
- Affected Versions
- NetScaler ADC and NetScaler Gateway 14.1-73.37 through 14.1-73.41, inclusive, when configured as a SAML IdP
- NetScaler ADC and NetScaler Gateway 13.1-64.23 through 13.1-64.28, inclusive, when configured as a SAML IdP
- NetScaler ADC and NetScaler Gateway builds earlier than 14.1-73.37 or 13.1-64.23 when configured as a SAML SP or SAML IdP
- Exploitation Status
- not_reported
- Exploit Availability
- none_reported
- Patch Status
- available
MITRE ATT&CK
CVE
People
Alex BernierCredited by Citrix for coordinated vulnerability disclosure; identified as a member of the JPMorgan Chase XOR Team.Chew Keong TanCredited by Citrix for coordinated vulnerability disclosure; identified as a member of the JPMorgan Chase XOR Team.Maxim SuhanovCredited by Citrix for coordinated vulnerability disclosure.Michael TuckerCredited by Citrix for coordinated vulnerability disclosure; identified as a member of the JPMorgan Chase XOR Team.
Vendors
CitrixCitrix has disclosed CVE-2026-107406, a critical memory overflow vulnerability affecting NetScaler ADC and NetScaler Gateway appliances configured for specific SAML authentication roles.Cloud Software GroupCitrix-managed cloud services and Citrix-managed Adaptive Authentication are handled separately because Cloud Software Group applies the necessary software updates to those managed environments.
Products
NetScaler ADCCitrix has disclosed CVE-2026-107406, a critical memory overflow vulnerability affecting NetScaler ADC and NetScaler Gateway appliances configured for specific SAML authentication roles.NetScaler GatewayCitrix has disclosed CVE-2026-107406, a critical memory overflow vulnerability affecting NetScaler ADC and NetScaler Gateway appliances configured for specific SAML authentication roles.Secure Private Access HybridSecure Private Access Hybrid deployments that use affected NetScaler instances are also exposed and require upgrades.