T
Threats
Citrix NetScaler: New Critical SAML Vulnerability Requires Further Patching
Overview
Products: Customer-managed Citrix NetScaler ADC and NetScaler Gateway.
CVE: CVE-2026-107406.
Severity: Critical, CVSS v4.0 9.5.
Advisory date: 14 October 2026.
Impact: Potential remote code execution or denial of service.
Conditions: SAML service provider (SP) or identity provider (IdP) configuration, subject to version-specific prerequisites. See Citrix security bulletin CTX697191.
Vendor dates: CTX697191 was initially published on 8 October 2026; its displayed last-modified date is 9 October 2026. See Citrix security bulletin CTX697191.
Citrix has disclosed a separate critical memory-overflow vulnerability affecting customer-managed NetScaler ADC and Gateway with version-specific SAML configurations. The flaw can enable remote code execution or denial of service, and some previously patched SAML identity-provider deployments still require newer fixes. See Citrix security bulletin CTX697191.
This advisory follows our 5 October NetScaler report. In its 9 October update, ASD's Australian Cyber Security Centre (ACSC) warned that previous patches for the earlier vulnerabilities are insufficient to address the latest issue.
What Has Changed?
The earlier CVE-2026-88779 is a High-severity SAML denial-of-service vulnerability, CVSS v4.0 8.7. The new CVE-2026-107406 is a separate Critical vulnerability with potential remote code execution as well as denial of service. Previous remediation targets, including 14.1-73.41 and 13.1-64.28, remain within the new vulnerability's affected SAML IdP ranges. See Citrix security bulletin CTX697174 and Citrix security bulletin CTX697191.
Exploitation status: In its 8 October guidance, Citrix stated that, as of bulletin publication, it was not aware of any unmitigated exploits of this vulnerability. The ACSC alert describes exploitation and Australian impacts associated with preceding issues. Those reports do not establish confirmed exploitation of the new CVE.
Affected Versions
Critical SAML vulnerability: CVE-2026-107406
Assess the installed build and SAML role together. Do not treat these ranges as a blanket statement that every NetScaler configuration is affected. The following entries follow Citrix security bulletin CTX697191.
NetScaler ADC and NetScaler Gateway 14.1
Affected: Builds before 14.1-73.37 when configured as SAML SP or SAML IdP; 14.1-73.37 through 14.1-73.41, inclusive, when configured as SAML IdP only.
Fixed: 14.1-73.46 and later releases in the appropriate product branch.
Not affected: SP-only deployments in the 14.1-73.37 through 14.1-73.41 range do not meet the vendor's IdP-only prerequisite. Deployments without SAML SP or SAML IdP configuration are outside this CVE's stated configuration scope, not necessarily free of other vulnerabilities.
NetScaler ADC and NetScaler Gateway 13.1
Affected: Builds before 13.1-64.23 when configured as SAML SP or SAML IdP; 13.1-64.23 through 13.1-64.28, inclusive, when configured as SAML IdP only.
Fixed: 13.1-64.29 and later releases in the appropriate product branch.
Not affected: SP-only deployments in the 13.1-64.23 through 13.1-64.28 range do not meet the vendor's IdP-only prerequisite. Deployments without SAML SP or SAML IdP configuration are outside this CVE's stated configuration scope, not necessarily free of other vulnerabilities.
NetScaler ADC 14.1-FIPS
Affected: Builds before 14.1-73.37 FIPS when configured as SAML SP or SAML IdP; 14.1-73.37 FIPS through 14.1-73.41 FIPS, inclusive, when configured as SAML IdP only.
Fixed: 14.1-73.46 FIPS and later releases in the appropriate product branch.
Not affected: SP-only deployments in the 14.1-73.37 FIPS through 14.1-73.41 FIPS range do not meet the vendor's IdP-only prerequisite. Deployments without SAML SP or SAML IdP configuration are outside this CVE's stated configuration scope, not necessarily free of other vulnerabilities.
NetScaler ADC 13.1-FIPS and 13.1-NDcPP
Affected: Builds before 13.1-37.279 when configured as SAML SP or SAML IdP; 13.1-37.279 through 13.1-37.282, inclusive, when configured as SAML IdP only.
Fixed: 13.1-37.283 and later releases in the appropriate product branch.
Not affected: SP-only deployments in the 13.1-37.279 through 13.1-37.282 range do not meet the vendor's IdP-only prerequisite. Deployments without SAML SP or SAML IdP configuration are outside this CVE's stated configuration scope, not necessarily free of other vulnerabilities.
Deployment Scope
Secure Private Access Hybrid deployments using affected customer-managed NetScaler instances are also in scope. Citrix-managed cloud services and Citrix-managed Adaptive Authentication receive the necessary updates from Cloud Software Group. This is a management-scope distinction, not a claim that managed services were never vulnerable. See Citrix security bulletin CTX697191.
Vulnerability Breakdown
CVE-2026-107406 - SAML memory overflow
Severity: Critical.
CVSS: 9.5, version 4.0.
Description: A memory-overflow vulnerability can lead to remote code execution or denial of service.
Impact: Potential appliance compromise or service disruption.
Conditions: Version-specific SAML SP or SAML IdP prerequisites, detailed in the branch entries above. The vendor CVSS vector specifies network access, high attack complexity, no privileges and no user interaction.
Action: Upgrade to the relevant fixed build above. The bulletin specifies upgrades, not an alternative temporary workaround.
CVE-2026-88779 - Earlier SAML denial of service
Severity: High.
CVSS: 8.7, version 4.0.
Description: This separately disclosed memory-overflow vulnerability causes denial of service. It is not the newly disclosed remote-code-execution issue.
Impact: Loss of service availability.
Conditions: SAML SP or SAML IdP configuration.
Vendor publication: 3 October 2026. The displayed changelog also records an additional blog link on that date.
The following historical fixes address the earlier CVE. Do not use them as the remediation target for the new Critical vulnerability where its IdP prerequisites apply. See Citrix security bulletin CTX697191.
NetScaler ADC and NetScaler Gateway 14.1
Affected: Builds before 14.1-73.41, with SAML SP or SAML IdP configuration.
Fixed: 14.1-73.41 and later releases in the appropriate branch, for this earlier CVE only.
Not affected: Deployments without SAML SP or SAML IdP configuration are outside this earlier CVE's stated configuration scope.
NetScaler ADC and NetScaler Gateway 13.1
Affected: Builds before 13.1-64.28, with SAML SP or SAML IdP configuration.
Fixed: 13.1-64.28 and later releases in the appropriate branch, for this earlier CVE only.
Not affected: Deployments without SAML SP or SAML IdP configuration are outside this earlier CVE's stated configuration scope.
NetScaler ADC 14.1-FIPS
Affected: Builds before 14.1-73.41 FIPS, with SAML SP or SAML IdP configuration.
Fixed: 14.1-73.41 FIPS and later releases in the appropriate branch, for this earlier CVE only.
Not affected: Deployments without SAML SP or SAML IdP configuration are outside this earlier CVE's stated configuration scope.
NetScaler ADC 13.1-FIPS and 13.1-NDcPP
Affected: Builds before 13.1-37.282, with SAML SP or SAML IdP configuration.
Fixed: 13.1-37.282 and later releases in the appropriate branch, for this earlier CVE only.
Not affected: Deployments without SAML SP or SAML IdP configuration are outside this earlier CVE's stated configuration scope.
Mitigation
Reopen the exposure check: Inspect the configuration for add authentication samlAction (SAML SP) and add authentication samlIdPProfile (SAML IdP). Compare the role and installed build with Citrix security bulletin CTX697191.
Upgrade affected instances urgently: Install 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS, or 13.1-37.283 for FIPS/NDcPP, or later releases in the appropriate branch. See Citrix security bulletin CTX697191. The 14.1 release notes and 14.1 FIPS release notes explicitly replace their 73.41 builds with 73.46. The 13.1 index and 13.1 FIPS index list the corresponding newer builds.
Use NetScaler Console where available: Open CVE Detection, then Impacted Instances, and search for the new CVE. Use Scan-Now for an on-demand scan; results can otherwise take a couple of hours. Select impacted instances and choose Proceed to upgrade workflow. See NetScaler Console remediation guidance.
Continue historical compromise assessment: Review evidence of compromise from at least 4 September 2026, as recommended in the ACSC's 30 September update. Review device logging for suspicious activity consistent with the earlier vulnerabilities and their configuration prerequisites. Installing another update does not replace this investigation.
Escalate suspected compromise: Contact Citrix support and report suspected or confirmed impacts to ASD's ACSC through the alert's assistance guidance.
Summary for IT Teams
Products: Customer-managed Citrix NetScaler ADC and Gateway, including relevant FIPS/NDcPP and Secure Private Access Hybrid instances.
Threat Level: Critical, CVSS v4.0 9.5, for the newly disclosed vulnerability. See Citrix security bulletin CTX697191.
Action Required: Confirm the SAML role and build, install the appropriate newer fixed release, and continue historical compromise assessment. Recheck previously patched IdP deployments. See Citrix security bulletin CTX697191 and ACSC mitigation advice.
Reference
Citrix CTX697191: critical SAML memory overflow and fixed builds
Citrix CTX697174: preceding SAML denial-of-service vulnerability
Citrix immediate guidance and publication-time exploitation statement
Need Help?
If your organisation needs assistance assessing exposure, planning remediation or investigating potential compromise, contact the Secure ISS SOC team on 1300 769 460 or email soc@secure-iss.com.bersecurity posture.
