Citrix has released fixes for CVE-2026-107406, another memory overflow in NetScaler ADC and Gateway appliances configured for SAML. Unlike last week's denial-of-service bug, this one can lead to remote code execution. SAML IdP appliances that took the fixes from the last two weeks are still in the affected range.
What happened
Citrix published guidance for CVE-2026-107406 on October 9, 2026. The Hacker News reports a CVSS score of 9.5 and quotes the Citrix bulletin:
"CVE-2026-107406 is a memory overflow vulnerability that may lead to remote code execution or denial-of-service under specific configuration conditions."
The conditions are the same SAML roles as before. The vulnerability affects appliances acting as a SAML service provider (add authentication samlAction) or SAML identity provider (add authentication samlIdPProfile). Secure Private Access hybrid deployments are also affected. According to The Hacker News, the affected range depends on the build:
- Builds before the September fixes (before 14.1-73.37, 13.1-64.23, and 13.1-37.279 for FIPS/NDcPP) are affected as either SAML SP or IdP.
- Builds 14.1-73.37 to 14.1-73.41, 13.1-64.23 to 13.1-64.28, and FIPS/NDcPP 13.1-37.279 to 13.1-37.282 are affected only when configured as a SAML IdP. That range includes the builds that fixed CVE-2026-88779.
Fixed releases are NetScaler ADC and Gateway 14.1-73.46 and later, 13.1-64.29 and later, 14.1-FIPS 14.1-73.46 FIPS and later, and 13.1-FIPS/NDcPP 13.1-37.283 and later. BleepingComputer reports that Citrix was not aware of any unmitigated exploits when the bulletin was published. The Hacker News credits Michael Tucker, Chew Keong Tan and Alex Bernier of the JPMorgan Chase XOR Team, along with Maxim Suhanov.
Why it matters
This is the third NetScaler security release since late September, after the batch that included the exploited CVE-2026-88771 and CVE-2026-88772 and the exploited SAML crash bug CVE-2026-88779. Two things are new here. The impact has moved from availability to possible code execution. And patching for the earlier issues does not cover this one if the appliance is a SAML IdP.
A NetScaler acting as a SAML IdP issues the assertions your applications trust. Code execution on that box puts the federation trust itself at risk: signing keys, active sessions, and every relying party downstream. Citrix reports no known exploitation yet, but both earlier releases fixed flaws that were exploited in the wild. BleepingComputer cites Shadowserver tracking about 21,000 internet-exposed NetScaler IP addresses (roughly 20,000 ADC and 1,500 Gateway), though their patch status is unknown.
What to check in your environment
- Re-run the SAML inventory from last week. List every NetScaler ADC, Gateway, FIPS, NDcPP and Secure Private Access hybrid instance with a
samlIdPProfileorsamlActionentry, and record which role each one plays. - Compare running builds against 14.1-73.46, 13.1-64.29 and 13.1-37.283. Treat any IdP on 14.1-73.41, 13.1-64.28 or 13.1-37.282 as unpatched, even if it was updated last week.
- Schedule the upgrade for SAML IdP appliances first, then SP appliances. Tell application owners who rely on them so a reboot window doesn't surprise them.
- Check whether your SAML IdP appliances are reachable from the internet, and limit management and IdP endpoints to the networks that need them.
- If an IdP appliance was exposed and unpatched, plan for what compromise would mean. Know where its SAML signing certificate is used and how you would rotate it across relying parties.
- Keep the compromise checks from the earlier NetScaler advisories in place. Review crash and restart history and unexpected processes on SAML-enabled appliances.