NetScaler CVE-2026-107406: SAML IdP at risk even after patching

For the third week running, Citrix has published a critical bulletin for customer-managed NetScaler ADC and NetScaler Gateway. The new vulnerability, CVE-2026-107406 (CVSS 4.0: 9.5), is a memory overflow in appliances configured for SAML authentication and can lead to remote code execution or denial of service. We briefly reported it in the article on the SAML zero-day CVE-2026-88779; below are the technical details that have since arrived with the national agencies’ advisories.

The key point for anyone running NetScaler: the builds installed in recent weeks to close the zero-days are not enough. If you updated for CVE-2026-88771, CVE-2026-88772 and CVE-2026-88779 and the appliance acts as a SAML identity provider, you have to update again.

What happened

Citrix’s bulletin (CTX697191) is dated 8 October. On 9 October it was picked up by the Canadian Centre for Cyber Security (advisory AV26-1023) and by Ireland’s NCSC, which recommends installing the updates “with the highest priority, after thorough testing”. On 12 October the Korean KrCERT/CC issued its own advisory.

According to CSO Online, Citrix says it is not aware of exploitation of the vulnerability on unmitigated systems. As of 9 October, the Irish NCSC reports, CVE-2026-107406 was not in CISA’s Known Exploited Vulnerabilities (KEV) catalog.

The sequence is still worrying. On 27 September Citrix fixed CVE-2026-88771 and CVE-2026-88772, which were already being exploited before the patch (see our article on the intrusions). A few days later came CVE-2026-88779, another memory overflow in SAML configurations, exploited to knock appliances offline. CVE-2026-107406 hits the SAML feature again, one that attackers have already targeted.

Technical details

• CVE: CVE-2026-107406, published on 8 October 2026.
• Weakness: CWE-119, improper restriction of operations within the bounds of a memory buffer (KrCERT/CC and Irish NCSC).
• Severity: critical, CVSS 4.0 score of 9.5.
• Impact: remote code execution or denial of service (Irish NCSC and CSO Online).
• Vector: network, against an appliance configured as a SAML service provider (SP) or identity provider (IdP). If exploited, it would map in MITRE ATT&CK to T1190 (Exploit Public-Facing Application) and, for the DoS effect, to T1499.004 (Endpoint Denial of Service: Application or System Exploitation).
• Known exploitation: none when the advisories were published; use by ransomware operators not reported.

Which configurations are affected

The condition depends on the version. The Irish NCSC advisory reproduces the bulletin’s breakdown:

• Only as a SAML IdP, the most recent builds are vulnerable, precisely the ones that fixed the zero-days:
  • NetScaler ADC and Gateway from 14.1-73.37 to 14.1-73.41 inclusive;
  • NetScaler ADC 14.1-FIPS from 14.1-73.37 FIPS to 14.1-73.41 FIPS inclusive;
  • NetScaler ADC and Gateway from 13.1-64.23 to 13.1-64.28 inclusive;
  • NetScaler ADC 13.1-FIPS and 13.1-NDcPP from 13.1-37.279 to 13.1-37.282 inclusive.
• As a SAML SP or IdP, earlier builds are vulnerable:
  • NetScaler ADC and Gateway before 14.1-73.37 and before 13.1-64.23;
  • NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS;
  • NetScaler ADC 13.1-FIPS and 13.1-NDcPP before 13.1-37.279.

In practice: on a late-September or early-October build, an appliance acting only as a SAML service provider is not affected; one acting as an identity provider is. On older builds any SAML configuration is enough. And anyone still on older builds also lacks the fixes for the exploited zero-days.

Fixed versions: 14.1-73.46 and later, 13.1-64.29 and later, 14.1-73.46 FIPS, and 13.1-37.283 for 13.1-FIPS and 13.1-NDcPP. All four sources agree on these numbers. The Canadian Centre for Cyber Security and KrCERT/CC list only the versions, without the configuration conditions.

Impact for European and Italian companies

NetScaler Gateway is often the remote access point for employees, suppliers and virtualised applications, and the SAML IdP role makes it the identity provider for other applications. Code execution on this component would give an attacker a privileged foothold on the perimeter; a DoS would stop the work of everyone who goes through it. In healthcare, that also means remote access to clinical systems.

Three urgent updates in three weeks on the same appliances put processes to the test. For NIS2 entities, vulnerability management must be documented, with explicit priorities and timelines: here you need evidence that every appliance with SAML has reached the 8 October builds, not just the late-September ones.

What to do now

1. Take an inventory of versions: list every NetScaler ADC and Gateway, including FIPS and NDcPP instances, with the installed build.
2. Check the SAML role: as noted in the article on CVE-2026-88779, an IdP configuration contains add authentication samlIdPProfile lines, an SP configuration add authentication samlAction lines. Prioritise IdP appliances, which are vulnerable even on the most recent builds.
3. Update: bring appliances to 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS or 13.1-37.283, even if you updated them only a few days ago. The new builds include the earlier fixes.
4. Don’t skip the zero-day checks: if an appliance is still on a build earlier than 14.1-73.37 or 13.1-64.23, it was also exposed to CVE-2026-88771 and CVE-2026-88772. Before updating, look for signs of compromise as described in the article on WHIPSHOT and SLAPSHOT.
5. Watch for signals: unexpected reboots or crashes of appliances with SAML enabled should be investigated, especially after the CVE-2026-88779 case.
6. Monitor the KEV catalog: if CISA adds CVE-2026-107406, treat every appliance that has not been updated as potentially compromised.

How ARXDOME helps

ARX Expose shows which services your company exposes on the Internet, which products are recognised on them and which have known vulnerabilities: it helps you quickly find the NetScaler appliances still to be updated. ARX Sentry collects network device logs in a central collector, so unusual reboots and suspicious connections from the perimeter stay in front of the analysts. With ARX Horizon you can look up vulnerabilities and indicators of compromise from the portal.

Last updated: 12 October 2026