Citrix Discloses Critical CVE-2026-107406 in NetScaler ADC and Gateway
Yet Another Urgent Update Required
Administrators must once again rush to update their NetScaler appliances merely days after implementing previous patches. Citrix recently issued an advisory detailing a critical vulnerability tracked as CVE-2026-107406. This severe flaw carries a staggering CVSS 4.0 severity score of 9.5. It specifically impacts NetScaler ADC and NetScaler Gateway deployments utilizing certain SAML configurations. Consequently, it can potentially lead to remote code execution or a devastating denial-of-service condition.
Understanding the Flaw
The security defect belongs to the CWE-119 classification, involving memory buffer boundary errors. Executing an attack requires no prior user authentication or administrative credentials. However, the CVSS vector notes a high attack complexity. The vulnerability manifests when the NetScaler appliance operates as a SAML Identity Provider (IdP) or, within legacy builds, as a SAML Service Provider (SP).
Impacted Software Versions
The range of vulnerable systems varies depending on the specific operational role of the device. NetScaler ADC and Gateway builds 14.1 (ranging from 73.37 to 73.41) and 13.1 (ranging from 64.23 to 64.28) remain vulnerable when functioning as a SAML IdP. Furthermore, older builds across these same branches face risks when configured as a SAML SP. This flaw also affects FIPS editions, NDcPP editions, and hybrid Secure Private Access deployments utilizing standalone NetScaler instances.
The Burden of Sequential Patching
This repetitive update cycle poses significant frustration for administrators who recently deployed the September security patches. For instance, specific builds such as 14.1-73.37 and 13.1-64.23 successfully mitigated prior vulnerabilities. However, they provide zero protection against the new CVE-2026-107406 flaw. Consequently, appliances previously deemed secure must undergo yet another mandatory update cycle.
Recommended Firmware Versions
Citrix provides specific patched builds to resolve this issue. For the 14.1 branch, administrators must upgrade to build 14.1-73.46. Meanwhile, the 13.1 branch requires upgrading to build 13.1-64.29. Users operating the 14.1-FIPS edition need version 14.1-73.46 FIPS. Finally, administrators managing 13.1-FIPS and 13.1-NDcPP editions must transition to version 13.1-37.283. Fortunately, Citrix manages cloud services and Adaptive Authentication instances autonomously; therefore, this advisory primarily concerns self-hosted NetScaler deployments.
Verifying Configurations and Assessing Risk
Administrators can determine their exposure by inspecting their SAML settings. The presence of a samlAction parameter indicates a Service Provider configuration. Conversely, a samlIdPProfile parameter signifies an Identity Provider role. Citrix strongly urges all organizations to transition to the latest patched builds immediately. At the time of publication, Citrix reported zero confirmed instances of active exploitation targeting CVE-2026-107406 in the wild.
This alarming vulnerability emerges amidst a relentless barrage of NetScaler security issues disclosed in recent weeks. In late September, threat actors actively exploited two critical zero-day flaws carrying 9.5 severity scores. Furthermore, Citrix patched an additional SAML vulnerability in early October. CVE-2026-107406 represents a distinct threat. It necessitates a fresh software update even for systems that administrators believed were fully secured.
