Citrix Issues Critical NetScaler Security Update for CVE-2026-107406
Citrix has warned of a critical memory overflow vulnerability in NetScaler ADC and NetScaler Gateway that could lead to remote code execution or denial of service. The flaw carries a CVSS v4.0 score of 9.5, and affected customers are urged to upgrade.
Xcademia Team
Citrix Issues Critical NetScaler Security Update for CVE-2026-107406
Citrix has published a critical security bulletin warning of a memory overflow vulnerability affecting customer-managed Citrix NetScaler ADC and Citrix NetScaler Gateway deployments. Tracked as CVE-2026-107406, the flaw could lead to remote code execution or denial of service under the conditions described by the company.
The vulnerability has a CVSS v4.0 base score of 9.5, placing it in the critical severity category. The affected products must meet specific version and configuration conditions involving Security Assertion Markup Language (SAML), which is used for exchanging authentication information between identity providers and service providers.
Cloud Software Group, Citrix's parent company, strongly urges affected customers to install the recommended updated versions as soon as possible.
The bulletin, identified as CTX697191, was last published on October 9, 2026. It also warns that Secure Private Access Hybrid deployments using NetScaler instances are affected.
What Is CVE-2026-107406?
CVE-2026-107406 is a memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
According to the Citrix security bulletin, the vulnerability can lead to remote code execution or denial of service. The bulletin classifies it under CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer.
Memory-related vulnerabilities can arise when software does not correctly restrict operations involving allocated memory. Depending on the flaw and the affected execution path, the consequences may include service disruption or the ability to execute unauthorised code.
Citrix's bulletin identifies SAML configuration as a prerequisite for affected deployments. The applicable conditions vary by product version and whether the appliance is configured as a SAML identity provider (IdP), a SAML service provider (SP), or both.
This means administrators need to assess both the software version and the appliance's configuration when determining exposure.
The published bulletin does not confirm that the vulnerability is being exploited in the wild. Organisations should avoid interpreting the critical severity rating as confirmation of active exploitation.
Why the Vulnerability Matters
The CVSS v4.0 base score for CVE-2026-107406 is 9.5 out of 10.
Citrix provides the following CVSS vector:
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:LThe vector describes the vulnerability's assessed characteristics:
AV:N: The attack vector is network-based.
AC:H: The assessment indicates high attack complexity.
AT:N: No additional attack requirements are indicated by this metric.
PR:N: The vector indicates that privileges are not required.
UI:N: User interaction is not required.
VC / VI / VA:H: The assessed impact on the vulnerable system's confidentiality, integrity, and availability is high.
SC / SI / SA:L: The vector also records impacts on subsequent systems, with high confidentiality and integrity impacts and low availability impact.
These are the published scoring metrics, not a guarantee that every affected deployment will experience the same impact. Actual exposure depends on the appliance version and configuration, while the bulletin's SAML prerequisites remain essential to assessing applicability.
Citrix identifies the potential outcomes as remote code execution or denial of service. The company does not disclose a confirmed exploitation count or report specific victim incidents in the supplied bulletin.
Which NetScaler Versions Are Affected?
Citrix lists several affected version ranges. The requirements differ depending on whether the appliance is configured as a SAML IdP or as a SAML SP or IdP.
Versions affected only when configured as a SAML IdP
The bulletin identifies these ranges as affected when the appliance is configured as a SAML identity provider:
NetScaler ADC and NetScaler Gateway 14.1: From 14.1-73.37 through 14.1-73.41, inclusive.
NetScaler ADC 14.1-FIPS: From 14.1-73.37 FIPS through 14.1-73.41 FIPS, inclusive.
NetScaler ADC and NetScaler Gateway 13.1: From 13.1-64.23 through 13.1-64.28, inclusive.
NetScaler ADC 13.1-FIPS: From 13.1-NDcPP 13.1-37.279 through 13.1-37.282, inclusive.
Versions affected when configured as a SAML SP or SAML IdP
The bulletin also identifies earlier versions that are affected when configured as either a SAML service provider or a SAML identity provider:
NetScaler ADC and NetScaler Gateway 14.1: Versions before 14.1-73.37.
NetScaler ADC 14.1-FIPS: Versions before 14.1-73.37 FIPS.
NetScaler ADC and NetScaler Gateway 13.1: Versions before 13.1-64.23.
NetScaler ADC 13.1-FIPS: Versions before 13.1-NDcPP 13.1-37.279.
Administrators should consult the official Citrix security bulletin to verify the precise applicability of these conditions to their deployment.
The version ranges should not be treated as a single blanket rule. In particular, the SAML IdP-only conditions for specified intermediate releases differ from the broader conditions affecting earlier versions configured as a SAML SP or IdP.
Which Versions Fix the Vulnerability?
Citrix strongly urges affected customers to upgrade to the following releases or later versions in the corresponding product branches:
Product branch | Recommended fixed version |
|---|---|
NetScaler ADC and NetScaler Gateway 14.1 | 14.1-73.46 or later |
NetScaler ADC and NetScaler Gateway 13.1 | 13.1-64.29 or later |
NetScaler ADC 14.1-FIPS | 14.1-73.46 FIPS or later |
NetScaler ADC 13.1-FIPS and 13.1-NDcPP | 13.1.37.283 or later |
Administrators should match the upgrade to the correct product and release branch. FIPS and NDcPP deployments have their own version requirements, so teams should not assume that a standard release number is interchangeable with a validated or specialised build.
Citrix recommends installing the updates as soon as possible. The bulletin does not provide a universal remediation deadline.
How Administrators Can Check SAML Configuration
Citrix provides two configuration entries that administrators can use to determine whether a NetScaler deployment is configured as a SAML service provider or identity provider.
For a SAML service provider, check for:
add authentication samlActionFor a SAML identity provider, check for:
add authentication samlIdPProfileThe presence of these entries can help administrators identify the relevant configuration. However, the correct vulnerability assessment also depends on the installed version and the version-specific conditions in the official bulletin.
Teams should review the configuration of each relevant appliance rather than relying on a single central inventory or assuming that all instances use identical authentication settings.
Secure Private Access Hybrid Deployments Are Also Affected
Citrix specifically notes that Secure Private Access Hybrid deployments using NetScaler instances are also affected by CVE-2026-107406.
Customers operating these environments should upgrade the relevant NetScaler instances to the recommended versions. The fact that a deployment is part of a hybrid access architecture does not remove the need to assess the underlying NetScaler software and configuration.
The bulletin distinguishes customer-managed products from Citrix-managed cloud services. It applies to customer-managed NetScaler ADC and NetScaler Gateway deployments.
Citrix states that Cloud Software Group upgrades its Citrix-managed cloud services and Citrix-managed Adaptive Authentication with the necessary software updates.
Organisations should therefore determine which components they manage themselves and which are maintained by Citrix, then follow the applicable remediation process for each.
What Security Teams Should Do Now
Given the critical rating and Citrix's explicit recommendation to upgrade promptly, security and infrastructure teams should prioritise the following actions.
Inventory NetScaler deployments: Identify customer-managed ADC and Gateway appliances, including those used in Secure Private Access Hybrid deployments.
Verify product versions: Match each appliance's exact release and build against the version-specific affected ranges.
Check SAML configuration: Review the relevant configuration entries and determine whether the SAML SP or IdP prerequisites apply.
Plan the correct upgrade: Select the recommended fixed version for the applicable standard, FIPS, or NDcPP branch.
Confirm remediation: Verify that each relevant appliance is running the intended fixed release after the upgrade.
Review vendor guidance: Monitor Citrix's security bulletin and associated technical guidance for updates.
These are practical steps based on Citrix's published requirements. The bulletin does not provide a separate workaround that can be presented as equivalent to installing the fixed release.
If teams need help applying the update, Citrix directs customers to its Technical Support portal.
Responsible Disclosure and Acknowledgement
Cloud Software Group acknowledged Joshua Foote, Michael Tucker, and Eugene Lim from the XOR Team at JPMorgan Chase for working with the company to help protect customers.
Citrix published the security bulletin through its Knowledge Center and recommends that customers subscribe to security alerts to receive notifications when bulletins are created or updated.
The company also provides a process for reporting potential security vulnerabilities through its Trust Center.
Conclusion
CVE-2026-107406 is a critical memory overflow vulnerability affecting certain configurations of customer-managed Citrix NetScaler ADC and NetScaler Gateway. With a CVSS v4.0 score of 9.5 and potential consequences that include remote code execution or denial of service, the issue warrants prompt attention from administrators of affected deployments.
The main priority is to determine whether each appliance meets the version-specific SAML conditions and then install the correct fixed release. Administrators should also account for FIPS and NDcPP builds and include NetScaler instances used in Secure Private Access Hybrid deployments.
Citrix has published version-specific remediation guidance, but the supplied bulletin does not confirm exploitation in the wild. Organisations should follow the official advisory, verify their exposure carefully, and confirm that the recommended update is installed.
Source: Citrix
About the Author