Citrix NetScaler ADC and Gateway: Memory overflow leading to RCE or DoS

Summary

A memory overflow (CWE-119) in NetScaler ADC and NetScaler Gateway can lead to remote code execution or denial of service. The flaw can be triggered without authentication over the network, but only on appliances configured as a SAML Service Provider (SP) or Identity Provider (IdP). The CVSS v4.0 base score is 9.5 (critical).

Affected

• NetScaler ADC and NetScaler Gateway before 14.1-73.46
• NetScaler ADC and NetScaler Gateway before 13.1-64.29
• NetScaler ADC 14.1-FIPS before 14.1-73.46 FIPS
• NetScaler ADC 13.1-FIPS before 13.1.37.283 FIPS
• Only when configured as SAML SP or SAML IdP; some builds are affected only as SAML IdP.

Fixed in

• NetScaler ADC and NetScaler Gateway 14.1-73.46 and later
• NetScaler ADC and NetScaler Gateway 13.1-64.29 and later
• NetScaler ADC 14.1-FIPS 14.1-73.46 FIPS and later
• NetScaler ADC 13.1-FIPS 13.1.37.283 FIPS and later

Workaround

Unknown. No vendor-endorsed workaround was found. Removing the SAML SP/IdP configuration where feasible may reduce exposure, but this has not been confirmed by the vendor.

Exploitation

• Citrix stated that it is not aware of any unmitigated exploits at publication.
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• No public proof-of-concept identified at the time of research.

Our recommendation

• Inventory all NetScaler ADC and Gateway appliances, their builds and whether SAML is configured.
• Patch SAML-configured appliances first to the fixed builds listed above, verifying against Citrix bulletin CTX697191.
• Review logs and restarts for crashes or unexpected processes.
• Monitor the Citrix bulletin and CISA KEV for changes in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (2 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  techupdate24/citrix-netscaler-rce-cve-2026-107406 · maxprog-svg/CVE-2026-107406

Research sources

• Citrix Security Bulletin CTX697191 support.citrix.com
• Citrix Community: Immediate guidance for CVE-2026-107406 community.citrix.com
• Tenable plugin 366457 www.tenable.com
• The Hacker News: Citrix patches critical NetScaler flaw thehackernews.com
• SOCPrime: CVE-2026-107406 critical NetScaler RCE flaw socprime.com
• CISA alert on Citrix NetScaler vulnerabilities www.cisa.gov

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:32.