Advisories
Citrix Releases Patch for CVE-2026-107406: Critical NetScaler Memory Overflow Enabling RCE in SAML Deployments
Citrix has issued security updates for NetScaler ADC and Gateway to fix CVE-2026-107406, a 9.5‑score memory overflow that can lead to remote code execution or denial‑of‑service when the appliance is configured as a SAML IdP or SP. All affected versions must be upgraded to 14.1‑73.46 or later, or 13.1‑64.29 or later, and Secure Private Access deployments should be reviewed.
What happened
Citrix disclosed a critical memory‑overflow flaw (CVE-2026-107406) in NetScaler ADC and Gateway that can be exploited when the appliance is set up as a SAML identity provider or service provider. The vulnerability carries a CVSS score of 9.5 and could allow attackers to execute arbitrary code or crash the system.
Impact
- Remote code execution or denial‑of‑service in SAML‑configured NetScaler instances.
- Affected releases: 14.1-73.37 to 14.1-73.41, 13.1-64.23 to 13.1-64.28, and corresponding FIPS builds; all earlier than 14.1-73.46 or 13.1-64.29.
- Secure Private Access and Hybrid deployments using NetScaler are also vulnerable.
What to do
- Verify deployment type by checking for add authentication samlAction (SP) or add authentication samlIdPProfile (IdP) in the configuration.
- Apply the latest patch: NetScaler ADC/Gateway 14.1-73.46+ or 13.1-64.29+.
- Re‑validate SAML configuration after upgrade and monitor logs for anomalous activity.
- If unable to upgrade immediately, restrict SAML traffic or isolate the appliance until the update is applied.
Mitigation status
Citrix has confirmed no evidence of exploitation in the wild, but the high severity warrants immediate action.
Related vulnerabilities
Citrix NetScaler RCE Vulnerability (CVE‑2026‑107406) Requires Immediate Patch
Citrix has disclosed a critical memory‑overflow flaw in NetScaler ADC and Gateway appliances that can be leveraged for remote code execution or denial‑of‑service when configured as a SAML IdP or SP. Affected systems must be upgraded to the latest patched releases without delay. No active exploits reported yet, but defenders should verify patch status and monitor traffic.
Read briefing
Citrix NetScaler ADC & Gateway Hit by Dual Critical Flaws – Patch Urgently
Citrix has disclosed two critical security issues in its NetScaler ADC and Gateway appliances. CVE‑2026‑19489 (memory overflow) can trigger DoS when SIP ALG is active on a Large‑Scale NAT group, while CVE‑2026‑19490 (auth bypass) targets Gateway or AAA virtual servers with SAML actions. Affected builds span 13.1 and 14.1 releases, including FIPS variants. CERT‑EU urges all users to apply the latest updates immediately and verify configuration strings to assess risk.
Read briefing
Citrix NetScaler ADC & Gateway Hit by Dual CVEs: Out‑of‑Bounds Read & Session Mix‑Up
Citrix has released an advisory for two high‑severity bugs in NetScaler ADC and Gateway. CVE‑2026‑3055 is an out‑of‑bounds read that can leak memory contents when the appliance acts as a SAML Identity Provider. CVE‑2026‑4368 is a race condition that can swap user sessions on Gateway or AAA virtual servers. No confirmed attacks yet, but the flaws demand immediate patching and network hardening.
Read briefing
CISA Adds CVE‑2026‑88779 to Known Exploited Vulnerabilities Catalog
CISA has added CVE‑2026‑88779, a Citrix NetScaler memory‑buffer overflow that allows attackers to gain full control of exposed assets, to its KEV catalog. Federal agencies must prioritize patching this high‑risk flaw per BOD 26‑04, while all organizations are encouraged to follow the same risk‑based approach. Defenders should verify patch status, monitor for exploitation indicators, and consider submitting unlisted KEVs.
Read briefing