home / blog
2026-11-01 · critical
CVE-2026-107406: Memory Overflow in NetScaler ADC
Critical memory overflow in NetScaler ADC. CVSS 9.5, RCE and DoS. Specific versions in SAML configuration.
CVE-2026-107406 is a memory overflow in Citrix NetScaler ADC and NetScaler Gateway enabling Remote Code Execution or Denial of Service. The vulnerability affects specific versions when devices are configured as SAML Service Provider (SP) or SAML Identity Provider (IdP). NetScaler ADC is a widely deployed load balancing and gateway solution across enterprises of all sectors, making this flaw critical for infrastructure.
CVSS score is 9.5 (critical), with maximum impact on confidentiality, integrity, and availability. The vulnerability was published on NVD on October 8, 2026. As of November 1, 2026, public signals indicate repository existence on GitHub claiming to contain exploits for CVE-2026-107406. Available data does not indicate whether the flaw is actively exploited in ongoing attacks.
Defenders must immediately inventory NetScaler ADC/Gateway instances in environment. Verify if they are configured as SAML SP or IdP: only these are vulnerable based on specific version. Apply patches as soon as Citrix releases them. Monitor SAML authentication service access logs and system-level access for signs of compromise.
At a glance
- What
- It is a memory overflow in NetScaler ADC/Gateway when configured as SAML Service Provider (SP) or SAML Identity Provider (IdP). Enables Remote Code Execution (RCE) or Denial of Service (DoS).
- Severity
- CVSS 9.5 - Critical. Direct impact on confidentiality, integrity, and availability of the system.
- Affected versions
- NetScaler ADC 14.1 (all versions; 14.1-73.37 to 14.1-73.41 as SAML IdP only). NetScaler ADC 13.1 (all versions; 13.1-64.23 to 13.1-64.28 as SAML IdP only). FIPS versions affected.
- Fix
- Not reported in NVD data. Check official Citrix announcements for specific patches and updates.
- Status
- Published on NVD October 8, 2026. Public repository signals on GitHub as of November 1, 2026.
- Action
- Inventory NetScaler ADC/Gateway instances in environment. Verify SAML configuration (SP/IdP). Apply patches when available. Monitor SAML service access logs.
Sources: NVD, CVE-2026-107406