Citrix patches CVE-2026-107406 SAML memory overflow

Citrix disclosed CVE-2026-107406 on October 8 as a critical memory-overflow vulnerability in customer-managed NetScaler ADC and NetScaler Gateway. Citrix says successful exploitation could lead to remote code execution or denial of service and assigns a CVSS v4.0 base score of 9.5. The affected appliance must use SAML, with the applicable role depending on the software release.

On the 14.1 and 13.1 release lines, versions before 14.1-73.37 or 13.1-64.23 are affected when configured as either a SAML service provider (SP) or identity provider (IdP). The ranges 14.1-73.37 through 14.1-73.41 and 13.1-64.23 through 13.1-64.28 are listed as affected only when configured as an IdP. Citrix lists corresponding FIPS and NDcPP ranges with the same role distinction in its bulletin.

Citrix recommends ADC and Gateway 14.1-73.46 or later, and 13.1-64.29 or later. The listed fixed builds are ADC 14.1-FIPS 14.1-73.46 FIPS or later and ADC 13.1-FIPS/NDcPP 13.1.37.283 or later. The bulletin says Secure Private Access Hybrid deployments using NetScaler instances are also affected; Citrix-managed cloud services are upgraded by the vendor.

This is separate from CVE-2026-88779, the earlier SAML memory-overflow issue that Citrix described as denial of service and that Norway’s NSM reported as actively exploited. Shared SAML preconditions and close disclosure dates do not establish a shared root cause or a connection between exploitation activity. The earlier exploitation reporting should not be transferred to CVE-2026-107406.

Operators should check their exact release and SAML role against Citrix’s version table, then install the fixed build listed for that release. Citrix’s bulletin includes commands to identify SAML SP and IdP configuration. This article reports the vendor’s disclosure and remediation guidance; it makes no claim about current exploitation of CVE-2026-107406.