NetScaler Releases Fixes for Critical CVE-2026-107406 in ADC and Gateway
A critical vulnerability in NetScaler ADC and NetScaler Gateway SAML configurations could allow remote code execution or denial of service. Fixed versions are now available.
NetScaler CVE-2026-107406 is a critical vulnerability in NetScaler ADC and NetScaler Gateway products for which Cloud Software Group has already released fixed versions. The memory overflow flaw has a CVSS v4 score of 9.5 out of 10 and, in a successful attack, could lead to remote code execution or denial of service.
The vendor urges customers with affected deployments to upgrade as soon as possible. On October 9, the Australian Cyber Security Centre also recommended deploying the latest fixes and warned that older patches intended for previous NetScaler flaws do not address this issue.
Who Is Affected by NetScaler CVE-2026-107406
The vulnerability applies to customer-managed NetScaler ADC and NetScaler Gateway instances. However, not every such system is affected: the requirement is a configuration using SAML in the role of a service provider (SAML SP) or identity provider (SAML IdP). The exact vulnerability conditions vary depending on the version branch in use.
Organizations use NetScaler ADC and Gateway to deliver applications and provide remote access. A flaw in the authentication configuration could therefore affect systems located at the network perimeter. However, the device being accessible from the internet is not proof of vulnerability; likewise, the presence of a SAML configuration does not automatically confirm it.
Fixed Versions Available
Cloud Software Group lists fixes in the following releases or newer versions:
- NetScaler ADC and NetScaler Gateway 14.1-73.46,
- NetScaler ADC and NetScaler Gateway 13.1-64.29,
- NetScaler 14.1-73.46 FIPS,
- NetScaler 13.1.37.283 FIPS/NDcPP.
According to the vendor, Cloud Software Group itself updates Citrix-managed cloud services and Citrix-managed Adaptive Authentication. Administrators of customer-operated instances must perform the update in their own environments.
Risk of Remote Code Execution Without Authentication
According to the bulletin, NetScaler CVE-2026-107406 could, with a vulnerable configuration, enable remote code execution without authentication or cause a denial of service. The fix is therefore particularly relevant to teams operating SAML SP or SAML IdP on ADC or Gateway devices.
When publishing the alert, Cloud Software Group stated that it was unaware of any unmitigated exploitation of the flaw. However, this statement does not independently confirm that no exploitation attempts occurred. No confirmed number of internet-accessible devices that are simultaneously vulnerable has been published either.
What Administrators Should Check
Organizations should identify customer-managed NetScaler ADC and Gateway systems, verify the version in use and the SAML configuration, and deploy the appropriate fixed build. For affected SAML deployments, it is also advisable to review available operational and security logs.
Further developments will depend on whether security vendors or authorities confirm active exploitation. The possible release of additional indicators of compromise or other mitigations by Cloud Software Group will also be important.
Sources
- Cloud Software Group / Citrix Support – The official bulletin confirms the CVE, the scope of affected configurations, CVSS 9.5, and the fixed builds.
- Australian Cyber Security Centre – Confirms the addition of CVE-2026-107406 to the current alert on October 9, 2026, and recommends applying the latest patches.
- BleepingComputer – Independently summarizes the vendor’s call for an urgent update and its statement at the time that it was unaware of any unmitigated exploitation.
Verified and updated: 10/09/2026 15:19
