CVE-2026-107406NetScaler memory overflow reachable through SAML IdP and SP configurations
What broke
Cloud Software Group published bulletin CTX697191 on October 8, 2026 for CVE-2026-107406 (CVSS v4.0 9.5, CWE-119), a memory overflow in NetScaler ADC and NetScaler Gateway that can lead to remote code execution or denial of service. It is only reachable when the appliance is configured for SAML: as a service provider (add authentication samlAction in the config) or as an identity provider (add authentication samlIdPProfile).
Version determines which role is exposed. Builds before 14.1-73.37 and 13.1-64.23 are affected in either role. Builds 14.1-73.37 through 14.1-73.41 and 13.1-64.23 through 13.1-64.28 are affected only as an IdP. Fixed: 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS, and 13.1-37.283 for FIPS and NDcPP. Secure Private Access hybrid deployments that use NetScaler are also affected. The bulletin does not report exploitation, and the flaw is not on CISA's KEV list.
Why it matters
A NetScaler configured as a SAML IdP is the identity provider for every application that trusts it. Code execution there means access to its signing keys, which lets an attacker mint assertions for any user in any federated app, and those assertions keep working after the box is patched. As an SP, the appliance is the remote access gateway, where a takeover yields live sessions.
Three other NetScaler flaws (CVE-2026-88771, CVE-2026-88772 and the SAML zero-day CVE-2026-88779) were added to KEV in the weeks before this bulletin, and both CVE-2026-19490 and CitrixBleed show how fast this product line goes from advisory to exploitation.
What to do
- Upgrade to 14.1-73.46 or 13.1-64.29 or later, or the matching FIPS and NDcPP builds.
- Grep running configs for
samlActionandsamlIdPProfileto size exposure, but do not rely on removing SAML as a fix. - Keep the management interface off untrusted networks.
After you patch
- If an IdP-mode appliance may have been reached, rotate its SAML signing certificate and update the metadata at every relying party.
- Terminate active AAA and ICA sessions after the upgrade.
Sources
Related identity CVEs
Related on Start with Identity
- BlogNetScaler patches a CVSS 9.5 memory overflow reachable only through SAML
CVE-2026-107406 can lead to remote code execution on NetScaler ADC and Gateway appliances configured as a SAML identity provider or service provider. Fixed in 1
- CVECheck Point Security Gateway information disclosure of password hashes
An unauthenticated read on Check Point Security Gateways leaked password hashes, including those used for VPN and local admin. CISA KEV. May 2024. Hash disclosu
- BlogExploited NetScaler SAML zero-day forces a second upgrade after the September patch
CVE-2026-88779 crashes NetScaler ADC and Gateway appliances configured as a SAML service provider or identity provider. Exploited before the fix, on CISA KEV si
- CVEruby-saml auth bypass, incomplete fix of CVE-2025-25292
The March 2025 ruby-saml patch did not close the parser differential. CVE-2025-54572 is the incomplete-fix follow-on: still a critical SSO impersonation if you
- PodcastAuth0
The late Vittorio Bertocci's interviews with the authors of OAuth, OpenID Connect, FIDO, and SAML. Ended in 2022, and still the best audio archive on identity s
- CVECisco SAML 2.0 mixes authorization domains
Cisco's SAML 2.0 implementation did not keep authorization domains apart. A token or assertion meant for one domain could authorize in another. May 2024. The pr