Cybersecurity
Citrix patches NetScaler flaw affecting SAML deployments
Citrix said it fixed CVE-2026-107406 in NetScaler ADC and NetScaler Gateway, a memory overflow flaw that could lead to remote code execution or denial of service in some SAML configurations.
- Citrix released patches for CVE-2026-107406 in NetScaler ADC and NetScaler Gateway.
- The company said the flaw was a memory overflow that could lead to remote code execution or denial of service under specific configuration conditions.
- Citrix said exploitation depended on deployments being configured as a SAML identity provider or service provider.
- Citrix credited Michael Tucker, Chew Keong Tan, Alex Bernier of the JPMorgan Chase XOR Team, and Maxim Suhanov for finding and reporting the issue.
- Citrix said there was no evidence that the flaw had been exploited in the wild, and it said the issue had been fixed in later releases including 14.1-73.46 and 13.1-64.29.
Citrix released patches for CVE-2026-107406 in NetScaler ADC and NetScaler Gateway. It said the issue was a memory overflow that could lead to remote code execution or denial of service in certain configurations, and it said there was no evidence of exploitation in the wild.
The company said the risk depended on the appliances being set up as a SAML identity provider or service provider. It told customers to check for SAML-related configuration entries when deciding whether their systems were affected.
Citrix said Secure Private Access Hybrid deployments using NetScaler instances were also affected. It said customers needed to upgrade those instances to the recommended NetScaler versions.
The company listed fixed releases as 14.1-73.46 and later for NetScaler ADC and NetScaler Gateway, 13.1-64.29 and later for 13.1, 14.1-73.46 FIPS and later for 14.1-FIPS, and 13.1.37.283 and later for 13.1-FIPS and 13.1-NDcPP.
The report also noted that three other NetScaler ADC and NetScaler Gateway flaws, CVE-2026-88771, CVE-2026-88772 and CVE-2026-88779, were under active exploitation in the wild.
Named in this story
People
- Michael Tucker
- was credited with discovering and reporting the flaw
- Chew Keong Tan
- was credited with discovering and reporting the flaw
- Alex Bernier
- was credited with discovering and reporting the flaw
- Maxim Suhanov
- was credited with discovering and reporting the flaw
Companies
- Citrix
- released the patches and warned about the flaw
Organisations
- JPMorgan Chase XOR Team
- included researchers credited by Citrix
Products and systems
- NetScaler ADC
- was one of the affected products
- NetScaler Gateway
- was one of the affected products
- CVE-2026-107406
- was the memory overflow flaw being patched
- Secure Private Access Hybrid
- was said to be affected when it used NetScaler instances
How the source tells it
Mostly neutral bulletin-style reporting, with a mild alarmist cast from repeated criticality language and the reference to other flaws being actively exploited.
- alarm the flaw was described with a high-severity label and linked to code execution
- urgency the piece ended by linking the fix to other NetScaler flaws already being exploited