Citrix Patches Critical NetScaler SAML Vulnerability CVE-2026-107406

For the third consecutive week, enterprise network administrators face an urgent update cycle for their Citrix NetScaler ADC and NetScaler Gateway deployments. The vendor’s latest security bulletin addresses a critical Citrix NetScaler ADC vulnerability tracked as CVE-2026-107406, which carries a near-maximum CVSS v4.0 rating of 9.5. Flaws of this nature in edge infrastructure present significant operational risks, as they allow unauthenticated attackers to trigger denial-of-service conditions or potentially execute arbitrary code on exposed NetScaler Gateway appliances.

SAML Architecture and Memory Corruption Risk

The underlying weakness for CVE-2026-107406 is categorized under CWE-119, representing improper restriction of operations within the bounds of a memory buffer. In NetScaler ADC and Gateway appliances, this memory overflow triggers when the system is configured as a SAML (Security Assertion Markup Language) Identity Provider (IdP). Older firmware versions remain vulnerable even when operating in the SAML Service Provider (SP) role.

SAML implementations inherently involve complex parsing of XML structures, assertion tokens, and cryptographic signatures at the network perimeter. When an incoming SAML authentication request or response is processed, inadequate bounds checking during memory allocation allows crafted network payloads to write past allocated buffer boundaries.

Because NetScaler appliances serve as primary ingress controllers for corporate applications—handling authentication termination, SSL decryption, and enterprise single sign-on (SSO)—a flaw in this component carries severe blast radius implications. Successful unauthenticated remote code execution grants an attacker local system privileges on the appliance OS, providing an ideal launchpad for credential harvesting, active session hijacking, and lateral movement into internal enterprise subnets.

Evaluating Threat Metrics: CVSS 9.5 vs. EPSS

While the CVSS v4.0 score of 9.5 reflects the maximum potential impact of unauthenticated remote code execution on edge hardware, the current Exploit Prediction Scoring System (EPSS) metric presents a initial baseline probability. As of October 9, 2026, the EPSS model estimates a 0.41% probability of exploitation in the wild over the next 30 days, placing it in the 33.7th percentile relative to all scored CVEs.

Security teams should avoid interpreting a low initial EPSS percentile as a reason to defer maintenance. EPSS models rely heavily on publicly observable telemetry, including published proof-of-concept (PoC) code, scanner activity, and threat actor infrastructure context. Because CVE-2026-107406 was published on October 8, 2026, malicious actors are likely actively reverse-engineering the binary patches to identify the vulnerable parsing routine. Given the high utility of NetScaler appliances to initial access brokers and ransomware operators, EPSS scores for unauthenticated edge vulnerabilities historically surge rapidly once functional PoC code circulates.

A Pattern of Memory Safety Challenges in Edge Appliances

This update represents the latest entry in an intensive series of emergency maintenance advisories from Citrix. The heightened remediation cycle began on Sunday, September 27, when Citrix advised NetScaler ADC and Gateway administrators to immediately take unpatched systems offline to remediate two critical unauthenticated remote code execution vulnerabilities under active zero-day exploitation.

The vendor followed that emergency cycle with advisories for CVE-2026-88779—a CVSS 8.7 memory overflow exploited in the wild to trigger denial-of-service conditions—and CVE-2026-3055, a critical memory overread vulnerability addressed in build 14.1-60.58. The recurrence of buffer overflows and memory overreads highlights ongoing memory safety challenges within legacy C-based networking stacks operating under high throughput requirements.

Upgrade Paths and Operational Guidance

Citrix confirmed it is not aware of active, unmitigated exploit campaigns targeting CVE-2026-107406 at the time of advisory publication. However, given the rapid weaponization window observed for previous NetScaler flaws, immediate patch application is recommended.

Administrators managing self-hosted instances must upgrade affected deployments to the following builds or later:

• NetScaler ADC and Gateway 14.1 Series: Upgrade to version 14.1-73.46 or later.
• NetScaler ADC and Gateway 13.1 Series: Upgrade to version 13.1-64.29 or later.
• NetScaler ADC 13.1-FIPS and 13.1-NDcPP: Upgrade to version 13.1.37.283 or later.

Organizations should verify whether SAML IdP or SP features are actively enabled by auditing authentication policies and virtual server configurations (add authentication samlAction bindings). If immediate maintenance windows cannot be scheduled, security operations teams should restrict administrative access, ensure management interfaces are isolated from public ingress, and monitor appliance process logs for abnormal restarts in packet-processing daemons that may signal exploit delivery attempts.