Patch NetScaler now to stop possible RCE on exposed devices

CVE-2026-107406 is a memory overflow, a bug where software writes data past the space set aside for it. Depending on conditions, that can let a remote attacker take over the device or knock it offline. It scores 9.5 out of 10 on the CVSS severity scale. No login or user action is needed, though the attack is rated as high complexity, which suggests it isn’t trivial to pull off.

Only appliances set up for SAML are affected. SAML is a standard for single sign-on, the system that lets you log in once and reach many work apps. A NetScaler can act as an identity provider (IdP), which vouches for who you are, or a service provider (SP), which accepts that proof. Secure Private Access hybrid deployments that use NetScaler are also affected. Citrix-managed cloud services and Citrix-managed Adaptive Authentication are not, because Citrix patches those itself.

At disclosure, Citrix said it wasn’t aware of any unmitigated exploits, and no public proof-of-concept code had been released. The flaw was reported by researchers from JPMorgan Chase’s XOR Team and by Maxim Suhanov.

This is the frustrating part for administrators. Which builds are exposed depends on what you’re running:

• Builds 14.1-73.37 to 14.1-73.41 and 13.1-64.23 to 13.1-64.28 (and their FIPS and NDcPP equivalents) are vulnerable only when the appliance acts as a SAML identity provider. These are the builds Citrix released in late September and early October to close actively exploited holes.
• Anything older than those builds is vulnerable when configured as either a SAML identity provider or a service provider.

In other words, teams that moved fast to patch last month’s attacks, and use NetScaler as an identity provider, are now running vulnerable software. There is no workaround. The only fix is to upgrade.

Citrix says to upgrade to these builds or later:

• NetScaler ADC and NetScaler Gateway 14.1-73.46
• NetScaler ADC and NetScaler Gateway 13.1-64.29 (later releases of 13.1)
• NetScaler ADC 14.1-FIPS 14.1-73.46 FIPS
• NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.283

To see whether a device uses SAML, search its configuration. The line “add authentication samlIdPProfile” means it is an identity provider. The line “add authentication samlAction” means it is a service provider. If either appears, prioritize that appliance.

NetScaler has had a rough few weeks. On Sept. 27, Citrix patched eight vulnerabilities, two of which (CVE-2026-88771 and CVE-2026-88772) were already being exploited as zero-days, meaning attackers found them before a fix existed. Those attacks let intruders plant web shells, steal credentials, gain root access and spread into victims’ networks, and hit government, financial, education, legal and professional services organizations.

On Oct. 3, Citrix disclosed CVE-2026-88779, another SAML bug that attackers used to crash appliances. Researchers suspect those crashes were deliberate, to speed up exploitation of CVE-2026-88771. Even so, it was the third publicly exploited NetScaler zero-day in roughly two weeks, which left many security teams working through back-to-back weekends. The US Cybersecurity and Infrastructure Security Agency added it to its list of known exploited vulnerabilities.

SAML handling has become a repeat weak spot. CVE-2026-107406 is the fourth SAML-related NetScaler flaw since March, following CVE-2026-3055 in March and CVE-2026-8451 in June. Overall, the agency has flagged 27 actively exploited Citrix vulnerabilities since November 2021, seven of them used in ransomware attacks. Each new SAML bug is another reason attackers keep probing these boxes, since a single foothold on a gateway can open the door to a whole corporate network.

If you manage NetScaler devices:

1. List every NetScaler ADC and Gateway appliance, including Secure Private Access hybrid setups.
2. Check each configuration for the SAML lines above.
3. Upgrade affected devices to 14.1-73.46, 13.1-64.29 or the matching FIPS and NDcPP builds, even if you patched on or after Oct. 3.
4. Review logs for signs of the earlier zero-days, since fixing a bug doesn’t remove an intruder who got in before.

The internet exposure is real. One internet-scanning group tracks more than 21,000 IP addresses showing NetScaler fingerprints, nearly 20,000 of them ADC appliances and just over 1,500 Gateway instances, though it’s unclear how many are patched, honeypots or using SAML.

If you’re an employee, there’s nothing to install yourself. But if your remote login suddenly goes down for maintenance this week, an emergency patch like this one could be why.