# NetScaler memory overflow reachable through SAML IdP and SP configurations

Source: https://startwithidentity.com/cves/cve-2026-107406/
Last updated: 2026-10-16
License: content by Start with Identity. Cite the source URL.

---

## What broke

Cloud Software Group published bulletin CTX697191 on October 8, 2026 for CVE-2026-107406 (CVSS v4.0 9.5, CWE-119), a memory overflow in NetScaler ADC and NetScaler Gateway that can lead to remote code execution or denial of service. It is only reachable when the appliance is configured for [SAML](https://startwithidentity.com/glossary/saml/): as a service provider (`add authentication samlAction` in the config) or as an identity provider (`add authentication samlIdPProfile`).

Version determines which role is exposed. Builds before 14.1-73.37 and 13.1-64.23 are affected in either role. Builds 14.1-73.37 through 14.1-73.41 and 13.1-64.23 through 13.1-64.28 are affected only as an IdP. Fixed: 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS, and 13.1-37.283 for FIPS and NDcPP. Secure Private Access hybrid deployments that use NetScaler are also affected. The bulletin does not report exploitation, and the flaw is not on CISA's KEV list.

## Why it matters

A NetScaler configured as a SAML IdP is the [identity provider](https://startwithidentity.com/glossary/identity-provider/) for every application that trusts it. Code execution there means access to its signing keys, which lets an attacker mint assertions for any user in any federated app, and those assertions keep working after the box is patched. As an SP, the appliance is the remote access gateway, where a takeover yields live sessions.

Three other NetScaler flaws (CVE-2026-88771, CVE-2026-88772 and the SAML zero-day [CVE-2026-88779](https://startwithidentity.com/cves/cve-2026-88779/)) were added to KEV in the weeks before this bulletin, and both [CVE-2026-19490](https://startwithidentity.com/cves/cve-2026-19490/) and [CitrixBleed](https://startwithidentity.com/cves/cve-2023-4966/) show how fast this product line goes from advisory to exploitation.

## What to do

- Upgrade to 14.1-73.46 or 13.1-64.29 or later, or the matching FIPS and NDcPP builds.
- Grep running configs for `samlAction` and `samlIdPProfile` to size exposure, but do not rely on removing SAML as a fix.
- Keep the management interface off untrusted networks.

## After you patch

- If an IdP-mode appliance may have been reached, rotate its SAML signing certificate and update the metadata at every relying party.
- Terminate active AAA and ICA sessions after the upgrade.

## Sources

- [NVD: CVE-2026-107406](https://nvd.nist.gov/vuln/detail/cve-2026-107406)
- [NetScaler bulletin CTX697191](https://support.citrix.com/external/article/CTX697191/citrix-netscaler-adc-and-citrix-netscale.html)
- [The Hacker News, October 9, 2026](https://thehackernews.com/2026/10/citrix-patches-critical-netscaler-flaw.html)