Karen IT Security Response Center (KSRC) Advisory

Advisory ID: KSRC-2026-11022 | Publication Date: 02 November 2026

Critical Memory Overflow in Citrix NetScaler ADC & Gateway
CVE-2026-107406

Summary

A critical memory overflow vulnerability has been identified in Citrix NetScaler ADC and NetScaler Gateway. The vulnerability, tracked as CVE-2026-107406, has been assigned a CVSS v4.0 score of 9.5 (Critical).

An unauthenticated remote attacker can trigger a memory overflow condition that may lead to Remote Code Execution (RCE) or Denial of Service (DoS). The flaw is present when the appliance is configured as a SAML Service Provider (SP) or SAML Identity Provider (IdP).

Technical Overview

The vulnerability is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). It exists in the SAML processing component of NetScaler ADC and Gateway. Successful exploitation allows an attacker to execute arbitrary code on the affected appliance or cause a denial of service, potentially leading to full compromise of the device and the applications it protects.

This issue is part of a series of critical NetScaler vulnerabilities disclosed in September and October 2026. Organizations running NetScaler with SAML configurations should treat this as a high-priority risk.

Affected Systems

• NetScaler ADC and NetScaler Gateway versions prior to 14.1-73.46
• NetScaler ADC and NetScaler Gateway versions prior to 13.1-64.29
• NetScaler ADC 14.1-FIPS versions prior to 14.1-73.46 FIPS
• NetScaler ADC 13.1-FIPS / NDcPP versions prior to 13.1.37.283 FIPS

Note: The appliance must be configured as a SAML SP or SAML IdP for the vulnerability to be exploitable.

Recommendations

1. Immediate Action: Upgrade affected NetScaler ADC and Gateway appliances to the fixed versions listed above as soon as possible.
2. If immediate patching is not possible, consider temporarily disabling SAML SP/IdP functionality if business requirements allow.
3. Restrict network access to the management and authentication interfaces to trusted networks only.
4. Monitor NetScaler logs for unusual SAML-related activity or unexpected process crashes.
5. Review Citrix Security Bulletin CTX697191 for the most up-to-date guidance and fixed build details.

Organizations using NetScaler ADC or Gateway as part of their authentication or application delivery infrastructure should prioritize this update due to the potential for remote code execution.

Karen IT
We make the Internet harder to abuse.