A 9.5 Flaw That Needs A Specific Setup
On 9 October Citrix released patches for CVE-2026-107406, a memory overflow in NetScaler ADC and NetScaler Gateway that may lead to remote code execution or denial of service under specific configuration conditions. It scores 9.5 on CVSS v4.0 and is classed as CWE-119, improper restriction of operations within a memory buffer.
Citrix says there is no evidence of exploitation in the wild, though The Register notes it didn't say whether the flaw was used as a zero-day before disclosure. Citrix credited researchers at the JPMorgan Chase XOR Team and Maxim Suhanov with finding it.
The Two-Line Check
The flaw can only be exploited when the appliance is configured as a SAML identity provider or service provider, and the configuration shows which.
The Hacker News lists two entries to look for. A SAML service provider carries a line starting add authentication samlAction, and a SAML identity provider carries one starting add authentication samlIdPProfile. Search your saved configuration for both. If neither exists, this particular condition isn't met, though that doesn't make the appliance exempt from the other NetScaler flaws below.
Which Builds Are Affected
Which builds are vulnerable depends on the SAML role. Older builds are exposed in either role, while some newer ones are exposed only as an identity provider.
| Branch | Exposed as SAML SP or IdP | Exposed only as SAML IdP | Fixed in |
|---|---|---|---|
| ADC and Gateway 14.1 | Before 14.1-73.37 | 14.1-73.37 to 14.1-73.41 | 14.1-73.46 and later |
| ADC 14.1-FIPS | Before 14.1-73.37 FIPS | 14.1-73.37 FIPS to 14.1-73.41 FIPS | 14.1-73.46 FIPS and later |
| ADC and Gateway 13.1 | Before 13.1-64.23 | 13.1-64.23 to 13.1-64.28 | 13.1-64.29 and later |
| ADC 13.1-FIPS and 13.1-NDcPP | Before 13.1-37.279 | 13.1-37.279 to 13.1-37.282 | 13.1-37.283 and later |
Secure Private Access Hybrid deployments that use NetScaler instances are also affected and need the same upgrade. Citrix handles updates for its managed cloud services and Adaptive Authentication, so customers there have nothing to install, while everyone running their own appliances must upgrade them.
The Same Feature Behind The Exploited Bugs
The Hacker News lists three other NetScaler flaws under active exploitation: CVE-2026-88771, CVE-2026-88772 and CVE-2026-88779. Google researchers said a campaign exploiting CVE-2026-88772 had been running since at least early September, with organisations in government, finance, legal and education across North America and Europe likely affected, The Register reports. Citrix disclosed CVE-2026-88779, rated 8.7, the previous Friday, and The Register notes that it and the new flaw are both memory overflows affecting SAML configurations.
Citrix hasn't identified the new flaw as exploited, and that is a statement about today. Because the same feature has produced exploited flaws in recent weeks, we'd plan on the assumption that attackers are reading this advisory too.
A Triage Order For This Week
Run the config check first, because it sorts your appliances into those to patch this week and those that can wait for the normal cycle.
Appliances with a SAML configuration go first, to 14.1-73.46, 13.1-64.29 or the matching FIPS build, and anything still missing the fixes for the three exploited flaws goes ahead of this one. If an upgrade can't happen within 72 hours, narrow who can reach the SAML endpoints in the meantime.
Then treat NetScaler like any internet-facing authentication gateway: one named owner, one advisory subscription and a standing patch window. Citrix has now issued a critical advisory on top of three exploited flaws within weeks, and a monthly cycle doesn't cover a pattern like that.
Read next: Patched In June, Exploited In August: NetScaler Flaw | CitrixBleed Returns, Exploited Within a Day
