Key points
- CVE-2026-107406 is rated CVSS 9.5 Critical by the NVD.
- The flaw enables remote code execution or denial of service in SAML configurations.
- Patches are available for NetScaler ADC and Gateway versions prior to 14.1-73.46 and 13.1-64.29.
Citrix has released security updates to address a critical vulnerability in its NetScaler ADC and NetScaler Gateway products. According to The Hacker News, the defect, tracked as CVE-2026-107406, allows attackers to execute remote code or cause a denial of service. The National Vulnerability Database rates the issue with a CVSS score of 9.5, classifying it as critical.
The vulnerability stems from a memory overflow that occurs under specific configuration conditions. SecurityWeek reports that Citrix is urging immediate patching to mitigate the risk. The flaw is not present in all deployments; it specifically affects systems configured as a SAML Service Provider (SP) or SAML Identity Provider (IdP). Without these specific SAML settings, the vulnerability does not apply.
Context and background
The memory overflow issue has been present in several versions of Citrix’s networking and security appliances. The Hacker News notes that Citrix described the flaw as leading to remote code execution or denial of service under specific configuration conditions. This means an attacker could potentially take control of the server or disrupt its availability if the system is misconfigured or left in a vulnerable state.
The severity of the issue is highlighted by the high CVSS score. A rating of 9.5 indicates that the exploitability is high and the impact on confidentiality, integrity, and availability is severe. For organisations relying on NetScaler for access management, this represents a significant attack surface if SAML authentication is in use.
Who is affected
The vulnerability impacts a wide range of NetScaler ADC and NetScaler Gateway versions. According to the NVD record, systems are affected if they are running versions prior to 14.1-73.46, prior to 13.1-64.29, prior to 14.1-73.46 FIPS, or prior to 13.1.37.283 FIPS.
Specific version constraints apply based on the SAML role. For systems configured as a SAML IdP, versions between 14.1-73.37 and 14.1-73.41, and between 13.1-64.23 and 13.1-64.28, are applicable. For systems configured as either a SAML SP or SAML IdP, versions before 14.1-73.37 and before 13.1-64.23 are at risk. FIPS-compliant versions have similar affected ranges, specifically before 14.1-73.37 FIPS and before 13.1-NDcPP 13.1-37.279.
Our take on the response
Citrix has provided patches to resolve the issue. SecurityWeek confirms that the vendor is urging immediate patching. Organisations using NetScaler ADC or Gateway should verify their current version against the affected list. If the system is configured for SAML, the risk is immediate until the update is applied.
What to do and how to stay safe: Citrix
- Check your NetScaler ADC and Gateway version against the affected list provided by Citrix.
- Verify if your instance is configured as a SAML Service Provider or Identity Provider.
- Apply the latest security patches released by Citrix to your affected systems.
- Monitor system logs for unusual activity that may indicate exploitation attempts.
Step-by-step guide: Out-of-Band Patches: How Emergency Updates Prevent Downtime
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-107406?
It is a critical memory overflow vulnerability in Citrix NetScaler ADC and Gateway that can lead to remote code execution or denial of service.
Which versions are affected?
Versions prior to 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS, and 13.1.37.283 FIPS are affected, specifically when configured as SAML SP or IdP.
Is there a fix available?
Yes, Citrix has released patches for the affected versions of NetScaler ADC and Gateway.