NetScaler patches a CVSS 9.5 memory overflow reachable only through SAML
CVE-2026-107406 can lead to remote code execution on NetScaler ADC and Gateway appliances configured as a SAML identity provider or service provider. Fixed in 14.1-73.46 and 13.1-64.29; no exploitation reported yet.
Cloud Software Group's bulletin CTX697191, published October 8, covers CVE-2026-107406, a memory overflow (CWE-119, CVSS v4.0 9.5) in NetScaler ADC and NetScaler Gateway that can lead to remote code execution or denial of service. It only applies when the appliance is configured for SAML. Builds before 14.1-73.37 and 13.1-64.23 are exposed as either a SAML service provider or identity provider; builds 14.1-73.37 to 14.1-73.41 and 13.1-64.23 to 13.1-64.28 only as an identity provider. Fixed releases are 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS and 13.1-37.283 FIPS/NDcPP. Secure Private Access hybrid deployments are also affected. The bulletin does not report exploitation, and the flaw is not in CISA's KEV catalog. Researchers from the JPMorgan Chase XOR team and Maxim Suhanov reported it.
Why it matters
When NetScaler is the SAML identity provider, its signing key is what every federated application trusts to say who a user is. Code execution on that box is a path to the key, and a stolen key forges logins for any user long after the patch. Full details are in our CVE-2026-107406 brief.
This lands days after the exploited SAML zero-day CVE-2026-88779 went onto KEV (two other NetScaler flaws were added in late September), and after the August Gateway and AAA authentication bypass. Check configs for samlIdPProfile and samlAction, upgrade, and if an IdP-mode appliance was exposed on an old build, rotate its SAML signing certificate and update relying party metadata.
Source: The Hacker News
Related on Start with Identity
- BlogFortinet's January SSO bypass hit boxes already patched for December's SAML bug
CVE-2026-24858 is the follow-on FortiCloud SSO SAML bypass. Devices patched for CVE-2025-59718 and 59719 were still exploitable. Actively exploited. CISA guidan
- BlogSonicWall SMA1000 gets a third CVSS 10 pre-auth SSRF this year
CVE-2026-102255 lets an unauthenticated attacker use an unintended access path in the SMA1000 WorkPlace interface to reach internal functions. CVSS 10.0, fixed
- BlogIvanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by a
- CVENetScaler Gateway and AAA authentication bypass with SAML configured
CVE-2026-19490 lets an attacker bypass authentication on NetScaler ADC and Gateway appliances running a Gateway or AAA virtual server. CVSS 9.3, shipped alongsi
- CVENetScaler SAML memory overflow exploited as a zero-day
CVE-2026-88779 is a memory overflow in NetScaler ADC and Gateway reachable only when the appliance acts as a SAML service provider or identity provider. Exploit
- CVECisco SAML 2.0 mixes authorization domains
Cisco's SAML 2.0 implementation did not keep authorization domains apart. A token or assertion meant for one domain could authorize in another. May 2024. The pr