Citrix issued a security bulletin Oct. 8 urging NetScaler administrators to patch a critical flaw that could allow remote code execution or denial of service. The vulnerability, tracked as CVE-2026-107406, carries a CVSS v4.0 score of 9.5.
Not every NetScaler device is exposed. The issue affects specific builds of NetScaler ADC and NetScaler Gateway configured to handle Security Assertion Markup Language (SAML) authentication. Although Citrix has not reported exploitation of this particular flaw, the disclosure follows several exploited NetScaler vulnerabilities. For security teams, identifying the right versions and authentication roles is the first step toward closing the gap.
Who's affected by CVE-2026-107406?
Citrix identifies the memory overflow as CWE-119. Older affected builds are exposed when configured as either a SAML service provider (SP) or identity provider (IdP). Some newer builds are vulnerable only in the IdP role.
The company's security bulletin outlines the affected builds and available fixes:
Product | Affected builds and SAML roles | Fixed build |
NetScaler ADC/Gateway 14.1 | Before 14.1-73.37: SP or IdP. Versions 14.1-73.37 through 14.1-73.41: IdP only | 14.1-73.46 or later |
NetScaler ADC/Gateway 13.1 | Before 13.1-64.23: SP or IdP. Versions 13.1-64.23 through 13.1-64.28: IdP only | 13.1-64.29 or later |
NetScaler ADC 14.1-FIPS | Before 14.1-73.37 FIPS: SP or IdP. Versions 14.1-73.37 through 14.1-73.41 FIPS, inclusive: IdP only | 14.1-73.46 FIPS or later |
NetScaler ADC 13.1-FIPS/NDcPP | Before 13.1-37.279: SP or IdP. Versions 13.1-37.279 through 13.1-37.282, inclusive: IdP only; confirm edition-specific applicability in Citrix’s advisory | 13.1.37.283 or later |
Secure Private Access Hybrid deployments using affected NetScaler instances also require updates.
Administrators can identify SAML configurations by checking for add authentication samlAction (SP) or add authentication samlIdPProfile (IdP).
Citrix updates its managed cloud services and managed Adaptive Authentication, but customers must patch their own NetScaler deployments, according to The Register.
More than 21,000 NetScaler IP addresses exposed
BleepingComputer reported that Shadowserver identified more than 21,000 internet-exposed IP addresses with NetScaler fingerprints, including approximately 1,500 Gateway and nearly 20,000 ADC instances.
However, the figures do not establish how many devices are unpatched, use vulnerable SAML configurations, or are honeypots.
The Hacker News noted that three separate vulnerabilities, CVE-2026-88771, CVE-2026-88772, and CVE-2026-88779, have already been exploited in attacks involving NetScaler.
Those attacks should not be confused with CVE-2026-107406, for which Citrix has reported no known unmitigated exploits.
What security teams should do now
IT and security administrators should prioritize three actions:
- Inventory affected appliances: Identify customer-managed NetScaler ADC, Gateway, and Secure Private Access Hybrid deployments.
- Verify configurations: Compare software versions against Citrix's advisory and check whether affected SAML SP or IdP settings are enabled.
- Patch and test: Install the applicable fixed version, verify the upgrade, and test authentication and remote access afterward.
For organizations relying on NetScaler Gateway for remote access, the risks extend beyond a single vulnerable device. A denial-of-service attack could prevent employees from accessing business applications, while successful remote code execution could compromise the appliance itself.
Security teams should confirm which NetScaler instances use SAML authentication, check their software versions, and apply the appropriate patches. They should also verify that employee sign-ins work after the upgrade.
Although Citrix has not reported exploitation of CVE-2026-107406, recent attacks involving other NetScaler vulnerabilities make delaying these updates a risky choice.
Related reading: Citrix recently patched another NetScaler SAML zero-day exploited in attacks. The earlier flaw, CVE-2026-88779, allowed attackers to disrupt affected systems.