Citrix urged customers to patch CVE-2026-107406 immediately. It is a memory overflow in NetScaler ADC and NetScaler Gateway, scored CVSS 4.0 9.5, that can lead to remote code execution or denial of service when the appliance is configured for SAML. Citrix said on 8 October 2026 that it was not aware of unmitigated exploitation.
What happened
The bug sits in SAML handling (CWE-119). Exposure depends on the build. Builds from 14.1-73.37 through 14.1-73.41, and 13.1-64.23 through 13.1-64.28, are affected only as a SAML identity provider. Older supported builds are affected as either a SAML service provider or identity provider. Those mid-September builds are the same ones that closed last month's exploited NetScaler flaws, so a box patched for the zero-days can still be exposed.
Fixed builds are 14.1-73.46 and later, 13.1-64.29 and later, 14.1-73.46 FIPS, and 13.1-37.283 for 13.1-FIPS and 13.1-NDcPP. Secure Private Access Hybrid deployments that use NetScaler are in scope. There is no workaround.
Who is affected
Organizations running NetScaler ADC or Gateway as a SAML SP or IdP on an affected build, including FIPS and NDcPP variants. A config line of add authentication samlIdPProfile means IdP mode. add authentication samlAction means SP mode.
What to do now
- Upgrade to 14.1-73.46, 13.1-64.29, or the matching FIPS build. Do not stop at last month's zero-day fix.
- Search the running config for SAML SP and IdP profiles so you know which appliances are in scope.
- After the upgrade, review authentication logs for unusual SAML requests.
Source: SecurityWeek, 9 October 2026, bulletin CTX697191.
Also on the blog
- GitLab CVE-2026-97229: CVSS 10 unauthenticated RCE
- Danfoss fridge controllers hijacked at 500 French stores
- Ledger LTE implant stole recovery phrases via CryptoBilis
- Anthropic cuts live internet from all internal Claude evaluations
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.