Citrix Patches NetScaler CVE-2026-107406, a 9.5 Memory Overflow Reachable Only on SAML Appliances

Citrix published a bulletin on October 8 for CVE-2026-107406, a memory overflow in NetScaler ADC and NetScaler Gateway that can lead to remote code execution or denial of service. It carries a CVSS v4.0 base score of 9.5, and it only applies to an appliance configured as a SAML service provider or identity provider.

The fix is an upgrade. Citrix's bulletin CTX697191 lists no workaround, and it covers customer-managed appliances only. Cloud Software Group says it has already upgraded Citrix-managed cloud services and Citrix-managed Adaptive Authentication.

Does your appliance have the SAML configuration

The precondition decides whether the 9.5 means anything for a given box. The bulletin tells customers to look in the running configuration for add authentication samlAction (service provider) or add authentication samlIdPProfile (identity provider). An appliance with neither line is outside the affected configurations. Secure Private Access Hybrid deployments that use NetScaler instances are also affected, according to the bulletin.

The vector is CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L. Network reachable, no privileges and no user interaction is the dangerous half. Attack complexity is rated high, and the score overstates the risk for any appliance that never enabled SAML while understating it for the internet-facing gateways that did. The bulletin classes the weakness as CWE-119, improper restriction of operations within the bounds of a memory buffer.

Affected and fixed builds

Branch	Vulnerable (IdP only)	Fixed in
14.1	14.1-73.37 to 14.1-73.41	14.1-73.46 and later
13.1	13.1-64.23 to 13.1-64.28	13.1-64.29 and later
14.1-FIPS	14.1-73.37 FIPS to 14.1-73.41 FIPS	14.1-73.46 FIPS and later
13.1-FIPS / NDcPP	13.1-37.279 to 13.1-37.282	13.1-37.283 and later

The table shows the builds that are vulnerable only when the appliance is a SAML identity provider. Per the bulletin, any build earlier than 14.1-73.37 or 13.1-64.23, including the FIPS and NDcPP equivalents, is vulnerable when configured as either a service provider or an identity provider. A fleet on older builds therefore has the wider exposure.

Exploitation: none reported, with a caveat

The Hacker News quotes Citrix: "There is no evidence that the issue has been exploited in the wild." That sentence was not in the portions of the bulletin The Terminal could retrieve, and Citrix's community blog post could not be fetched, so the claim rests on The Hacker News's quotation.

The same report says three other NetScaler flaws, CVE-2026-88771, CVE-2026-88772 and CVE-2026-88779, have come under active exploitation. The Terminal found no reported exploitation of CVE-2026-107406 itself.

Who found it, and a credit discrepancy

The bulletin credits Joshua Foote, Michael Tucker and Eugene Lim of the XOR Team at JPMorgan Chase. The Hacker News lists Michael Tucker, Chew Keong Tan and Alex Bernier of the same team along with Maxim Suhanov. The two lists overlap on one name. The bulletin's initial publication date is October 8, and its "Updated On" field was blank when fetched, so the credits may change.

Federal deadlines do not apply yet, since the flaw is not in CISA's catalogue. For context on how those clocks run, see how CISA set a three-day deadline for five older flaws and why the Apple CoreGraphics date conflicted with its own guidance. The next event to watch is a listing in CISA's Known Exploited Vulnerabilities catalogue, which would start a federal clock.