NetScaler: Citrix patches new critical SAML-related flaw (CVE-2026-107406)

On October 8, 2026, Citrix published security bulletin CTX697191. It covers a new critical vulnerability in NetScaler ADC and NetScaler Gateway. Tracked as CVE-2026-107406, it has a CVSS v4.0 score of 9.5 out of 10. It is a memory overflow (CWE-119) that could allow remote code execution or cause a denial of service. Citrix says it is not aware of any "unmitigated" exploitation as of the publication date.

Only SAML configurations are affected

To be vulnerable, the appliance must use SAML (Security Assertion Markup Language), the single sign-on protocol, as an identity provider (IdP) or as a service provider (SP). According to The Register, older builds are vulnerable in both roles. Some more recent builds are vulnerable only as an identity provider. Hybrid Secure Private Access deployments that rely on NetScaler must also be updated. Citrix states that it handles updates to its managed cloud services and Adaptive Authentication itself.

This alert follows a string of bad news. In September, CVE-2026-88771 and CVE-2026-88772 were exploited before patches were released. In early October, CVE-2026-88779, a denial-of-service flaw, was exploited in turn. According to BleepingComputer, the Shadowserver Foundation counts more than 21,000 IP addresses exposed on the internet that show the NetScaler fingerprint. It is unknown how many are actually vulnerable.

Fixed versions

• NetScaler ADC and Gateway 14.1-73.46 and later;
• NetScaler ADC and Gateway 13.1-64.29 and later;
• NetScaler ADC 14.1-FIPS 14.1-73.46 and later;
• NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.283 and later.

Warning: according to the analysis published by Citrix specialist Poppelgaard.com, builds released recently to fix the previous flaws (up to 14.1-73.41 and 13.1-64.28) remain vulnerable when the appliance acts as an identity provider. The end-of-life 13.0 and 12.1 branches are affected and will not receive a patch.

What to do

• Check for a SAML profile, even if it is not in use. Poppelgaard.com suggests the command grep -E "add authentication saml(Action|IdPProfile)" /nsconfig/ns.conf. A line containing samlIdPProfile indicates the identity provider role, the most exposed one.
• Install the fixed builds listed above. The bulletin offers no workaround.
• Move off the 13.0 and 12.1 branches to a supported version.
• Review the logs if the September patches were applied late: an appliance that has since been updated may have been compromised beforehand.