Citrix urges immediate patching of new critical NetScaler SAML flaw

Cloud Software Group, Citrix's parent, published a security bulletin on October 8 for CVE-2026-107406, a memory overflow vulnerability (CWE-119, CVSS v4 9.5) in customer-managed NetScaler ADC and NetScaler Gateway that can lead to remote code execution or denial of service. Appliances are only affected when configured as a SAML service provider or SAML identity provider; for some recent builds, only the identity-provider configuration is vulnerable.

Citrix strongly urges customers to install NetScaler ADC and Gateway 14.1-73.46 or 13.1-64.29 or later, 14.1-73.46 FIPS, or 13.1-37.283 for the 13.1-FIPS and NDcPP lines. Admins can check exposure by looking for "add authentication samlAction" or "add authentication samlIdPProfile" in the configuration. Secure Private Access hybrid deployments that use NetScaler also need upgrading; Citrix-managed cloud services are being updated by the company. The flaw was reported by researchers from JPMorgan Chase's XOR team.

Citrix says it is not aware of any unmitigated exploits. The warning follows a series of NetScaler problems: the exploited zero-days CVE-2026-88771 and CVE-2026-88772, added to CISA's Known Exploited Vulnerabilities catalog on September 27, and the CVE-2026-88779 denial-of-service zero-day that hit appliances already patched against them.