Critical CVE-2026-107406 Flaw Hits Citrix NetScaler SAML
NetScaler administrators face an increasingly frustrating reality, compelled to deploy device updates mere days after concluding a previous wave of frantic patching. Citrix recently issued an urgent advisory regarding CVE-2026-107406, a critical vulnerability commanding a formidable 9.5 rating on the CVSS 4.0 scale. This severe flaw profoundly impacts NetScaler ADC and NetScaler Gateway appliances operating within specific SAML configurations, presenting a perilous pathway to catastrophic remote code execution or devastating denial-of-service conditions.
The Mechanics of the Memory Buffer Vulnerability
This critical issue is classified beneath the CWE-119 designation, fundamentally rooted in operations egregiously violating permissible memory buffer boundaries. Notably, launching an attack requires neither prior authentication nor any interaction from the victim; however, the official CVSS vector explicitly acknowledges a high degree of complexity inherent to successful exploitation. The vulnerability actively exposes the appliance when NetScaler functions as a SAML Identity Provider (IdP) or, concerning legacy builds, when configured as a SAML Service Provider (SP).
The precise spectrum of affected systems intrinsically depends upon the designated role of the appliance. NetScaler ADC and Gateway builds traversing versions 14.1-73.37 through 73.41, alongside 13.1-64.23 through 64.28, are acutely vulnerable when operating specifically as a SAML IdP. Furthermore, antecedent builds within those identical branches remain susceptible even when configured strictly as a SAML SP. The vulnerability’s reach also encompasses the specialized FIPS and NDcPP editions, in addition to hybrid Secure Private Access deployments utilizing proprietary NetScaler instances.
The Frustration of Successive Patching Requirements
This mandated secondary update proves particularly exasperating for diligent administrators who only recently finalized the deployment of crucial September patches. Certain specific builds, namely 14.1-73.37 and 13.1-64.23, successfully mitigated the preceding vulnerabilities; lamentably, they afford absolutely zero protection against this novel CVE-2026-107406 threat. Appliances confidently considered secure mere days ago now definitively require immediate re-updating within specific SAML operational configurations.
To achieve mitigation within the 14.1 branch, administrators must rapidly deploy build 14.1-73.46, whereas the 13.1 branch necessitates the immediate installation of 13.1-64.29. Users operating the highly secure 14.1-FIPS iteration require version 14.1-73.46 FIPS, while build 13.1-37.283 is definitively verified as secure for both the 13.1-FIPS and 13.1-NDcPP editions. Citrix assumes sole responsibility for autonomously updating its proprietary cloud services and Adaptive Authentication infrastructure; therefore, this urgent security bulletin is exclusively directed toward proprietors of self-managed, on-premises NetScaler hardware.
Identifying Vulnerable Configurations
Administrators can conclusively determine their system’s susceptibility by meticulously scrutinizing their existing SAML configurations. The presence of the “samlAction” parameter unequivocally indicates a Service Provider configuration, whereas the “samlIdPProfile” designates the Identity Provider role. Citrix vehemently recommends an immediate, prioritized migration to the patched, secure builds. At the precise moment of the bulletin’s publication, the company officially maintained that no confirmed instances of active exploitation targeting vulnerable systems utilizing CVE-2026-107406 had been detected.
This novel critical error materializes against an unsettling backdrop of successive NetScaler vulnerabilities aggressively disclosed throughout recent weeks. In late September, sophisticated threat actors actively exploited two distinct, critical zero-day vulnerabilities, both carrying a staggering 9.5 CVSS score. Subsequently, in early October, Citrix hastily mitigated yet another, separate SAML-related flaw. CVE-2026-107406 represents an entirely distinct and exceptionally severe threat, mandating a completely new, comprehensive update cycle, even for appliances that administrators previously believed were unequivocally fortified.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
