Citrix has released updates to address the critical CVE-2026-107406 vulnerability in NetScaler ADC and NetScaler Gateway. Under certain SAML settings it can lead to remote code execution or denial of service. Organizations that use NetScaler as a SAML identity provider or consumer, including Secure Private Access hybrid deployments, are at risk and must urgently update vulnerable instances to fixed versions, despite the lack of confirmed exploitation so far.
Technical details of the vulnerability and affected configurations
According to the Citrix advisory CTX697191 describing the vulnerability, CVE-2026-107406 is a memory overflow that can be used for:
- remote execution of arbitrary code (RCE);
- rendering the device inoperable (DoS).
The vulnerability has been assigned a CVSS score of 9.5 out of 10, placing it in the critical category. At the time of publication, Citrix had not observed any exploitation of the vulnerability in the wild. The vendor notes that a successful attack is only possible with certain configurations related to SAML authentication:
- if NetScaler is configured as a SAML service provider (SP), the configuration contains lines of the form add authentication samlAction;
- if NetScaler is configured as a SAML identity provider (IdP), the configuration contains lines of the form add authentication samlIdPProfile.
Affected versions when acting as SAML IdP
When the device is used as a SAML IdP, the vulnerability affects the following version branches:
- NetScaler ADC and NetScaler Gateway:
- from 14.1-73.37 through 14.1-73.41 inclusive;
- from 13.1-64.23 through 13.1-64.28 inclusive.
- NetScaler ADC 14.1-FIPS:
- from 14.1-73.37 FIPS through 14.1-73.41 FIPS inclusive.
- NetScaler ADC 13.1-FIPS:
- from 13.1-NDcPP 13.1-37.279 through 13.1-37.282 inclusive.
Affected versions when acting as SAML SP or IdP
If NetScaler is used as a SAML SP or IdP, all earlier releases of the following branches are vulnerable:
- NetScaler ADC and NetScaler Gateway:
- all versions prior to 14.1-73.37;
- all versions prior to 13.1-64.23.
- NetScaler ADC 14.1-FIPS:
- all versions prior to 14.1-73.37 FIPS.
- NetScaler ADC 13.1-FIPS:
- all versions prior to 13.1-NDcPP 13.1-37.279.
The vulnerability has been fixed in the following versions, which Citrix recommends as a safe target level:
- NetScaler ADC and NetScaler Gateway:
- 14.1-73.46 and later;
- 13.1-64.29 and subsequent releases of the 13.1 branch.
- NetScaler ADC 14.1-FIPS:
- 14.1-73.46 FIPS and newer releases.
- NetScaler ADC 13.1-FIPS and 13.1-NDcPP:
- 13.1-37.283 and later versions of these lines.
Additional details on the CVSS assessment and characteristics of the vulnerability can be tracked via the NVD entry for CVE-2026-107406 (once it is published).
Threat context: a series of attacks on NetScaler
The fix for CVE-2026-107406 comes against the backdrop of three other vulnerabilities in NetScaler ADC and NetScaler Gateway — CVE-2026-88771, CVE-2026-88772, and CVE-2026-88779 — already being actively exploited. NVD entries for them will also appear or are already available at:
- CVE-2026-88771
- CVE-2026-88772
- CVE-2026-88779
This creates an unfavorable backdrop for any new NetScaler vulnerabilities: even if CVE-2026-107406 itself is not yet being used in attacks, the presence of other actively exploited flaws in the same product sharply increases attackers’ motivation to quickly develop exploits for it as well. In effect, every unpatched device becomes a significantly more attractive target.
Citrix specifically emphasizes that Secure Private Access Hybrid deployments that use NetScaler instances are also vulnerable. The company has published recommendations for immediate actions in a note on the community portal with practical guidance on CVE-2026-107406.
Impact assessment on business and infrastructure
The highest risk is to organizations where NetScaler serves as:
- a central point of remote access to internal applications;
- a SAML identity provider or consumer for critical business systems;
- a node in a Secure Private Access hybrid architecture.
A memory overflow with the potential for RCE in such a component means that an attacker could potentially:
- gain control over the device at the network perimeter;
- substitute or intercept authentication sessions;
- use NetScaler as a foothold for further penetration into the internal network;
- disrupt the availability of remote access and internal web applications via a DoS effect.
Even if the scope of an attack is limited to denial of service, the consequences will be substantial: downtime of remote access, disruption of shifts, unavailability of internal portals, and delays in processing customer operations. In the event of successful RCE, compromise of credentials and session data becomes possible, which in turn creates risks of unauthorized access to systems that use SAML authentication.
Practical recommendations for protection
1. Immediate prioritization of updates
- Identify all NetScaler ADC / NetScaler Gateway instances exposed to the internet or used in critical internal segments.
- Compare their versions with the lists of vulnerable and fixed releases in the Citrix CTX697191 advisory.
- If SAML settings are present (lines add authentication samlAction or add authentication samlIdPProfile in the configuration), treat such instances as “critical” priority.
- Update them at least to:
- 14.1-73.46 or later for the 14.1 branch;
- 13.1-64.29 or later for the 13.1 branch;
- 14.1-73.46 FIPS or 13.1-37.283 and higher for FIPS/NdcPP variants.
2. Secure Private Access Hybrid
- If you use Secure Private Access Hybrid, inventory all involved NetScaler nodes.
- Check their versions and roles (SAML IdP/SP) and update to the recommended releases in line with the Citrix guidance on the community portal for mitigating CVE-2026-107406.
3. Temporarily reducing the attack surface
If an immediate update is not possible (for example, due to complex testing procedures), it makes sense to consider temporary measures:
- migrating to an updated cluster those virtual servers where SAML authentication is used;
- disabling non-critical SAML profiles or SAML virtual servers where this is acceptable from a business requirements standpoint;
- restricting direct access to NetScaler administrative interfaces to internal addresses/maintenance windows only.
4. Monitoring and response
- Increase monitoring of NetScaler logs for authentication anomalies, process failures, and spikes in errors.
- Correlate suspicious activity with known indicators of attacks on other CVEs in NetScaler (CVE-2026-88771, CVE-2026-88772, CVE-2026-88779), using data from NVD and industry reports.
- Prepare rollback scenarios and a business continuity plan in case an emergency restart or temporary decommissioning of the device becomes necessary.
The key takeaway for Citrix NetScaler operators is this: if your infrastructure uses SAML configurations or Secure Private Access hybrid deployments, you must, during the next planned maintenance window, update all involved NetScaler ADC and NetScaler Gateway instances to versions no lower than 14.1-73.46 or 13.1-64.29 (and for FIPS/NdcPP — to 13.1-37.283), after first inventorying SAML settings using the specified configuration lines and strengthening monitoring for the period before and after the update.
