Citrix patches critical NetScaler memory overflow enabling remote code execution in SAML identity and service providers

Citrix patched CVE-2026-107406, a memory overflow in NetScaler ADC and Gateway rated 9.5 that can lead to remote code execution or denial of service under specific configurations. Exploitation requires the appliance to be configured as a SAML identity provider or service provider, which administrators can confirm by checking for samlAction or samlIdPProfile entries; Secure Private Access Hybrid deployments using NetScaler are also affected. Fixed builds include 14.1-73.46 and 13.1-64.29 along with the corresponding FIPS releases. Citrix reports no evidence of exploitation for this flaw, though three other recent NetScaler vulnerabilities, CVE-2026-88771, CVE-2026-88772, and CVE-2026-88779, are under active exploitation.

Check

Check NetScaler configurations for SAML identity or service provider entries, and upgrade affected ADC and Gateway builds to 14.1-73.46 or 13.1-64.29 and the matching FIPS releases.

Affected

NetScaler ADC or Gateway configured as a SAML identity or service provider can be driven to remote code execution or denial of service by the memory overflow flaw.

Fix

Apply the fixed NetScaler releases, review SAML configuration exposure, and keep monitoring, since three other NetScaler flaws are already under active exploitation.