Citrix has fixed a critical flaw in NetScaler ADC and NetScaler Gateway that could let an attacker take
over the appliance or crash it, without logging in. It affects appliances set up for single sign-on using
SAML (Security Assertion Markup Language), which is common on remote access gateways. No
attacks have been reported yet, but other NetScaler flaws were exploited within weeks last month, so
organisations should check their SAML setup and install Citrix’s fixed versions now.
1. Vulnerability Details
CVE ID- CVE-2026-107406
CVSS SCORE- 9.5 (Critical) CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L
EXPLOIT STATUS- No known exploitation; no public proof-of-concept
Citrix bulletin CTX697191, published 8 October 2026, describes a memory overflow (CWE-119: Improper Restriction of
Operations within the Bounds of a Memory Buffer) that can lead to remote code execution or denial of service. The
appliance must be configured for SAML. On builds before 14.1-73.37 and 13.1-64.23, either a SAML service provider
(SP) or identity provider (IdP) setup is vulnerable. On 14.1-73.37 to 14.1-73.41 and 13.1-64.23 to 13.1-64.28, only a
SAML IdP setup is vulnerable. Configuration lines “add authentication samlAction” (SP) and “add authentication
samlIdPProfile” (IdP) show which applies.
2. Affected Products & Fixed Versions
| COMPONENT | VULNERABLE VERSIONS | FIXED BUILD |
| NetScaler ADC and NetScaler Gateway 14.1 | Before 14.1-73.37 (SAML SP or IdP); 14.1-73.37 to 14.1-73.41 (SAML IdP only) | 14.1-73.46 and later |
| NetScaler ADC 14.1-FIPS | Before 14.1-73.37 FIPS (SAML SP or IdP); 14.1-73.37 FIPS to 14.1-73.41 FIPS (SAML IdP only) | 14.1-73.46 FIPS and later |
| NetScaler ADC and NetScaler Gateway 13.1 | Before 13.1-64.23 (SAML SP or IdP); 13.1-64.23 to 13.1-64.28 (SAML IdP only) | 13.1-64.29 and later |
| NetScaler ADC 13.1-FIPS and 13.1-NDcPP | Before 13.1-37.279 (SAML SP or IdP); 13.1-37.279 to 13.1 37.282 (SAML IdP only) | 13.1.37.283 and later |
3. Observed Activity
Secure Private Access hybrid deployments using NetScaler instances are also affected. Citrix-managed cloud services
and Citrix-managed Adaptive Authentication are patched by Citrix and need no customer action.
- Exploitation status: Citrix states it is not aware of any unmitigated exploits. CISA’s vulnrichment record lists exploitation as none and automatable as no. No public proof-of-concept or indicators of compromise have been released, and Citrix lists no workaround.
- Recent NetScaler exploitation (September 2026):CISA added CVE-2026-88771 and CVE-2026-88772 (both CVSS 9.5) to its Known Exploited Vulnerabilities catalogue on 27 September 2026. GreyNoise recorded the first exploitation attempt on 24 September.
4. Recommendations
- Search every NetScaler ADC and Gateway configuration, including Secure Private Access hybrid instances, for “add authentication samlAction” or “add authentication samlIdPProfile”, then compare the build against the affected ranges.
- Upgrade to 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS, or 13.1.37.283 FIPS/NDcPP or later, starting with internet-facing appliances that use SAML.
- Confirm the September fixes for the exploited CVE-2026-88771 and CVE-2026-88772 are also in place on the same appliances, and check them for signs of compromise.
5. Sources
- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697191
- https://community.citrix.com/techzone-blogs/110_security-updates/protecting-customers-immed
iate-guidance-for-cve-2026-107406-in-netscaler-adc-and-netscaler-gateway-r1631/ - https://thehackernews.com/2026/09/cisa-says-attackers-are-exploiting-two.html
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.