CVE-2026-107406: Memory overflow vulnerability leading to Remote Code Execution or Denial of Service

Q: Which SAML roles are affected in each version range?

Versions before 14.1-73.37, 14.1-73.37 FIPS, 13.1-64.23, or 13.1-NDcPP 13.1-37.279 are affected when configured as either a SAML service provider (SP) or identity provider (IdP). The listed later ranges are affected only when configured as a SAML IdP: 14.1-73.37 through 14.1-73.41, 14.1-73.37 FIPS through 14.1-73.41 FIPS, 13.1-64.23 through 13.1-64.28, and 13.1-NDcPP 13.1-37.279 through 13.1-37.282.

Q: Are deployments that do not use SAML affected?

The vulnerability requires NetScaler ADC or NetScaler Gateway to be configured as a SAML SP or SAML IdP. Based on the provided scope, systems without either SAML role configured are not affected.

Q: How can I determine whether an appliance is in scope?

Check the appliance product and version, then verify whether it is configured as a SAML SP, SAML IdP, or both. For the later version ranges identified in the advisory, only an IdP configuration is in scope; for versions earlier than the stated thresholds, either SAML role is in scope.

Published Oct 8, 2026

Updated

Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC.

NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements:

For the following versions: Applicable only when configured as a SAML IdP: NetScaler ADC and NetScaler Gateway between 14.1-73.37 and 14.1-73.41, inclusive NetScaler ADC 14.1-FIPS between 14.1-73.37 FIPS and 14.1-73.41 FIPS, inclusive NetScaler ADC and NetScaler Gateway between 13.1-64.23 and 13.1-64.28, inclusive NetScaler ADC 13.1-FIPS between 13.1-NDcPP 13.1-37.279 and 13.1- 37.282, inclusive

For the following versions: Applicable only when configured as a SAML SP or SAML IdP:

NetScaler ADC and NetScaler Gateway before 14.1-73.37 NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS NetScaler ADC and NetScaler Gateway before 13.1-64.23 NetScaler ADC 13.1-FIPS before13.1-NDcPP 13.1-37.279

Affected Software

4 affected components

Citrix NetScaler ADC>=14.1-73.37<=14.1-73.41, >=13.1-64.23<=13.1-64.28, <14.1-73.37, <13.1-64.23

Citrix NetScaler Gateway>=14.1-73.37<=14.1-73.41, >=13.1-64.23<=13.1-64.28, <14.1-73.37, <13.1-64.23

Citrix NetScaler ADC 14.1-FIPS>=14.1-73.37 FIPS<=14.1-73.41 FIPS, <14.1-73.37 FIPS

Citrix NetScaler ADC 13.1-FIPS>=13.1-NDcPP 13.1-37.279<=13.1-NDcPP 13.1-37.282, <13.1-NDcPP 13.1-37.279

Event History

Oct 8, 2026

CVE Published

via MITRE·09:18 PM

Data Sourced

via MITRE·09:18 PM

Description

Frequently Asked Questions

Which SAML roles are affected in each version range?

Versions before 14.1-73.37, 14.1-73.37 FIPS, 13.1-64.23, or 13.1-NDcPP 13.1-37.279 are affected when configured as either a SAML service provider (SP) or identity provider (IdP). The listed later ranges are affected only when configured as a SAML IdP: 14.1-73.37 through 14.1-73.41, 14.1-73.37 FIPS through 14.1-73.41 FIPS, 13.1-64.23 through 13.1-64.28, and 13.1-NDcPP 13.1-37.279 through 13.1-37.282.

Are deployments that do not use SAML affected?

The vulnerability requires NetScaler ADC or NetScaler Gateway to be configured as a SAML SP or SAML IdP. Based on the provided scope, systems without either SAML role configured are not affected.

How can I determine whether an appliance is in scope?