CVE-2026-107406: NetScaler SAML Fix Needs Another Fix
Citrix has patched another critical NetScaler flaw in the same SAML code path attackers hit earlier this month. Nobody has reported exploitation yet. The awkward part: the builds many teams rushed out last week to stop the previous SAML zero-day fall inside the vulnerable range if the appliance acts as a SAML identity provider.
What: CVE-2026-107406, a memory overflow (CWE-119) in Citrix NetScaler ADC and NetScaler Gateway that can lead to remote code execution or denial of service. CVSS v4.0 9.5. Citrix bulletin CTX697191.
Status: Patched October 8, 2026. Citrix says it is not aware of unmitigated exploits. Only appliances configured as a SAML service provider (SP) or identity provider (IdP) are exposed.
Deadline: No CISA KEV listing or federal due date as of this writing. Given three exploited NetScaler flaws in the past month, plan to finish within 72 hours.
Fix: Upgrade to NetScaler ADC and Gateway 14.1-73.46 or 13.1-64.29 or later (14.1-73.46 FIPS; 13.1.37.283 for 13.1-FIPS and NDcPP).
Key takeaways
- CVE-2026-107406 is a CVSS 9.5 NetScaler memory overflow that can allow remote code execution. It only affects appliances set up for SAML authentication, as an SP or an IdP.
- Last week’s patch is not enough for SAML IdP appliances. Builds 14.1-73.37 through 14.1-73.41 and 13.1-64.23 through 13.1-64.28 are vulnerable in IdP mode. That range includes the builds that fixed the exploited CVE-2026-88779.
- Older builds are exposed in either SAML role. Anything before 14.1-73.37 or 13.1-64.23 is vulnerable whether the appliance is an SP or an IdP.
- The fix is an upgrade, not a setting. Citrix lists no workaround. Move to 14.1-73.46 or 13.1-64.29 or later.
- No exploitation has been reported, but the clock is short. Earlier 2026 NetScaler bugs came under attack within days of a patch, according to one report.
Executive Summary
This is the fourth critical NetScaler problem in about a month, and it lands on the same feature as the last one.
On October 8, Citrix’s parent Cloud Software Group published bulletin CTX697191 for CVE-2026-107406. It describes a memory overflow in NetScaler ADC and NetScaler Gateway that may lead to remote code execution or a denial of service, but only when the appliance is configured for SAML. Citrix scores it 9.5 under CVSS v4.0 and credits researchers on JPMorgan Chase’s XOR team.
Citrix is not aware of attacks using the flaw, and we found no CISA KEV listing. That is the good news. The bad news is the context. In September, two NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, were used to break in. In early October, attackers hit the SAML zero-day CVE-2026-88779 to crash appliances, and CISA gave agencies three days to fix it. CVE-2026-107406 needs the same SAML configuration.
The bottom line: find every NetScaler appliance with a SAML action or SAML IdP profile, and upgrade it to 14.1-73.46 or 13.1-64.29 or later this week. If you fixed CVE-2026-88779 last week, you probably have to do it again.
Why This Matters to CISOs and Security Leaders
SAML NetScalers carry your remote-access front door. An appliance acting as a SAML IdP or SP sits between the internet and single sign-on for staff, contractors and applications. Code execution there gives an attacker a position to watch or steer authentication traffic.
Patch fatigue is the real risk. Teams that upgraded twice in two weeks will be tempted to read “no exploitation” as permission to wait. NetScaler’s 2026 record argues otherwise. BleepingComputer reports that CVE-2026-3055 and CVE-2026-4368 were patched in March only days before attacks started, and that CISA has flagged 27 exploited Citrix flaws since November 2021, seven of them used by ransomware gangs.
The change-window collision is tomorrow. Microsoft’s October Patch Tuesday lands on October 13. If NetScaler upgrades get pushed behind Windows work, SAML appliances could sit on a known critical flaw for another week.
Ask your network team one question: “Which of our NetScalers are SAML identity providers, and what build are they on right now?” If anyone answers “the one we installed for the last zero-day,” that appliance is still exposed.
The Timeline
| Date (2026) | What happened |
|---|---|
| March | NetScaler CVE-2026-3055 and CVE-2026-4368 patched, then exploited days later (per BleepingComputer) |
| September | CVE-2026-88771 and CVE-2026-88772 exploited as zero-days for remote code execution |
| Sunday, Oct 4 | CISA adds the SAML denial-of-service zero-day CVE-2026-88779 to KEV |
| Wednesday, Oct 7 | CISA federal deadline for CVE-2026-88779 (fixed in 14.1-73.41 and 13.1-64.28) |
| Thursday, Oct 8 | Citrix publishes CTX697191 for CVE-2026-107406; NetScaler Console adds detection |
| Friday, Oct 9 | The Hacker News, BleepingComputer and Security Affairs report the flaw; Citrix says it is not aware of unmitigated exploits |
| Monday, Oct 12 | No public reports of exploitation; no KEV listing found |
| Tuesday, Oct 13 | Microsoft Patch Tuesday competes for the same change windows |
For SAML identity providers, “patched last week” and “vulnerable this week” describe the same build.
Vulnerability & Exploit Analysis
What CVE-2026-107406 is
Citrix describes CVE-2026-107406 as a memory overflow, classified as CWE-119 (improper restriction of operations within a memory buffer), that may lead to remote code execution or denial of service. The CVSS v4.0 vector lists network access, no privileges and no user interaction, with high impact on confidentiality, integrity and availability. It also rates attack complexity as high, which suggests a working exploit is not trivial to build. Citrix has not published technical details, and no proof-of-concept has been reported.
Who is exposed
Only customer-managed NetScaler ADC and Gateway appliances configured for SAML are affected. Citrix says to search the running configuration for two strings:
add authentication samlActionmeans the appliance is a SAML service provider.add authentication samlIdPProfilemeans the appliance is a SAML identity provider.
Secure Private Access hybrid deployments that run on NetScaler instances are also affected. Citrix-managed cloud services and Citrix-managed Adaptive Authentication are being updated by Cloud Software Group.
Affected and fixed versions
| Branch | Vulnerable as SAML IdP only | Vulnerable as SAML SP or IdP | Fixed in |
|---|---|---|---|
| ADC and Gateway 14.1 | 14.1-73.37 to 14.1-73.41 | Before 14.1-73.37 | 14.1-73.46 and later |
| ADC and Gateway 13.1 | 13.1-64.23 to 13.1-64.28 | Before 13.1-64.23 | 13.1-64.29 and later |
| ADC 14.1-FIPS | 14.1-73.37 FIPS to 14.1-73.41 FIPS | Before 14.1-73.37 FIPS | 14.1-73.46 FIPS and later |
| ADC 13.1-FIPS and 13.1-NDcPP | 13.1-37.279 to 13.1-37.282 | Before 13.1-37.279 | 13.1.37.283 and later |
Citrix’s bulletin lists no workaround. Its guidance is to upgrade as soon as possible. NetScaler Console users can find affected instances under CVE Detection, then Impacted Instances, and launch an upgrade job from there. Citrix says the scheduled scan may take a couple of hours to pick up the CVE, so use Scan-Now for faster results.
The fixed builds for last week’s exploited SAML zero-day, CVE-2026-88779, were 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS and 13.1-37.282 for FIPS and NDcPP. Each one is the top of the “IdP only” vulnerable range for CVE-2026-107406. An appliance that was upgraded exactly as CISA asked on October 7 is still open to this flaw if it serves as a SAML identity provider. Compliance dashboards that track “CVE-2026-88779 remediated” will show green on those boxes.
Threat Intelligence Breakdown
Exploitation: None reported. Citrix told reporters it is not aware of unmitigated exploits, and as of October 12 we found no honeypot reports, no public exploit code and no CISA KEV entry for CVE-2026-107406.
Attribution: Not applicable yet. No threat actor has been linked to this flaw. Attacks on CVE-2026-88779 reportedly included attempts to download a script that installs webshells, according to Help Net Security, but nothing connects that activity to CVE-2026-107406.
Indicators of compromise: None published. Citrix’s bulletin includes no IoCs, and none of the reporting we reviewed listed any. If exploitation begins, watch for crashes and unexpected reboots on SAML appliances, the symptom defenders saw with CVE-2026-88779.
Exposure: Shadowserver tracks more than 21,000 internet-exposed IP addresses fingerprinted as NetScaler, about 1,500 Gateway and nearly 20,000 ADC, according to BleepingComputer (single-source). How many use SAML, or are already patched, is unknown.
Enterprise Impact: What’s Actually at Risk
Single sign-on: A compromised SAML IdP can affect every application that trusts it. Treat any confirmed compromise as an identity incident, not just a network-device incident.
Remote access availability: Even without code execution, a crash takes down VPN and application access. CVE-2026-88779 showed that repeated triggering can keep appliances offline.
Session and credential data: Appliances in the authentication path handle session tokens and, depending on setup, credentials. Code execution there puts that data within an attacker’s reach.
Audit trail: Expect auditors and insurers to ask why an appliance marked “remediated” for one SAML zero-day was vulnerable to the next. A clear record of builds, dates and upgrade decisions will help.
What Security Leaders Should Do Next
Today
- Inventory every NetScaler ADC and Gateway, including DR, lab and regional units, and record the exact build.
- Check for SAML configuration by searching for
add authentication samlActionandadd authentication samlIdPProfile. Flag every match. - Prioritize SAML IdP appliances on 14.1-73.37 to 73.41 or 13.1-64.23 to 64.28. They are the ones your last patch cycle may have marked as safe.
- Schedule the upgrade to 14.1-73.46 or 13.1-64.29 or later (or the matching FIPS and NDcPP builds) ahead of Patch Tuesday work.
Within 48 hours
- Finish upgrades on all SAML-configured appliances and confirm the running build after reboot.
- Update your tracking: make sure dashboards list CVE-2026-107406 separately, so a “CVE-2026-88779 fixed” status does not hide it.
- Restrict management interfaces to trusted networks if they are not already, and confirm logging from NetScaler reaches your SIEM.
Long-term
- Treat NetScaler as a standing emergency-change asset with a named owner and pre-approved windows, given four critical issues in about a month.
- Document which appliances use SAML and in which role. This bulletin shows the role decides exposure.
- Review whether SAML IdP duties need to sit on an internet-facing edge appliance at all, or could move to an identity platform with a smaller attack surface.
Get zero-day alerts before they hit the headlines
DataWater’s executive threat briefing: the exploited CVEs, the deadlines and the first three actions to take.
Winners and Losers
| Better positioned | More exposed |
|---|---|
| Teams that track NetScaler exposure by SAML role, not just by build | Teams that closed CVE-2026-88779 and moved on |
| NetScaler Console users who can scan and push upgrades in one workflow | Organizations patching NetScaler by hand across many sites |
| Appliances that are SAML SPs on 14.1-73.37 or later (IdP-only range does not apply) | SAML IdP appliances on last week’s fixed builds |
| Teams with pre-approved emergency windows for edge devices | Teams queuing NetScaler behind Patch Tuesday |
Final Executive Takeaway
No one is exploiting CVE-2026-107406 yet. That is the window, not a reason to wait.
The flaw sits in the same SAML feature attackers targeted this month, and the most recent fixed builds for SAML identity providers are themselves affected.
Find your SAML NetScalers. Upgrade to 14.1-73.46 or 13.1-64.29. Do it before the next exploit report, not after.
Frequently Asked Questions
What is Citrix NetScaler CVE-2026-107406?
CVE-2026-107406 is a memory overflow in Citrix NetScaler ADC and NetScaler Gateway that may allow remote code execution or denial of service. Citrix rates CVE-2026-107406 at CVSS v4.0 9.5 and disclosed it in bulletin CTX697191 on October 8, 2026.
Is NetScaler CVE-2026-107406 being exploited?
No exploitation of NetScaler CVE-2026-107406 had been reported as of October 12, 2026. Citrix said it was not aware of unmitigated exploits, and CVE-2026-107406 was not found on CISA’s Known Exploited Vulnerabilities catalog at the time of writing.
Which NetScaler configurations are affected by CVE-2026-107406?
CVE-2026-107406 affects only NetScaler appliances configured as a SAML service provider or SAML identity provider. Look for add authentication samlAction (SP) or add authentication samlIdPProfile (IdP) in the configuration. Secure Private Access hybrid deployments on NetScaler are also affected by CVE-2026-107406.
Which builds fix NetScaler CVE-2026-107406?
Citrix fixed CVE-2026-107406 in NetScaler ADC and Gateway 14.1-73.46 and 13.1-64.29 and later, NetScaler ADC 14.1-73.46 FIPS and later, and 13.1.37.283 and later for 13.1-FIPS and 13.1-NDcPP. Citrix lists no workaround for CVE-2026-107406.
Does the CVE-2026-88779 patch protect against NetScaler CVE-2026-107406?
Not for SAML identity providers. The builds that fixed CVE-2026-88779, such as 14.1-73.41 and 13.1-64.28, fall inside the range Citrix lists as vulnerable to CVE-2026-107406 when the NetScaler is a SAML IdP. Those appliances need to move to 14.1-73.46 or 13.1-64.29 or later.
Is there a CISA deadline for NetScaler CVE-2026-107406?
No. As of October 12, 2026, NetScaler CVE-2026-107406 had no CISA KEV listing and therefore no federal due date. If exploitation is confirmed, CISA could add CVE-2026-107406 with a short deadline, as it did with CVE-2026-88779’s three-day window.
How can I find NetScaler appliances vulnerable to CVE-2026-107406?
In NetScaler Console, open CVE Detection, then Impacted Instances, and search for CVE-2026-107406. Use Scan-Now because the scheduled scan can take a couple of hours to reflect CVE-2026-107406. Without Console, check each appliance’s build and SAML configuration by hand.
Sources
Primary sources: Citrix security bulletin CTX697191 for CVE-2026-107406 (published October 8, 2026); NetScaler Console guidance for CVE-2026-107406; CISA Known Exploited Vulnerabilities catalog. Additional reporting reviewed: The Hacker News, BleepingComputer (exposure figures and NetScaler history, single-source), Security Affairs and Help Net Security (CVE-2026-88779 fixed builds and KEV dates). Reflects public reporting as of October 12, 2026.
