[ CVE-2026-107406 · Published 8 Oct 2026 ]
Vulnerability in NetScaler ADC
[ Why it matters ]Priority signals
- Critical severity: CVSS 9.5
[ Description ]Official description
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC. NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements: * For the following versions: Applicable only when configured as a SAML IdP: * NetScaler ADC and NetScaler Gateway between 14.1-73.37 and 14.1-73.41, inclusive * NetScaler ADC 14.1-FIPS between 14.1-73.37 FIPS and 14.1-73.41 FIPS, inclusive * NetScaler ADC and NetScaler Gateway between 13.1-64.23 and 13.1-64.28, inclusive * NetScaler ADC 13.1-FIPS between 13.1-NDcPP 13.1-37.279 and 13.1- 37.282, inclusive For the following versions: Applicable only when configured as a SAML SP or SAML IdP: * NetScaler ADC and NetScaler Gateway before 14.1-73.37 * NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS * NetScaler ADC and NetScaler Gateway before 13.1-64.23 * NetScaler ADC 13.1-FIPS before13.1-NDcPP 13.1-37.279
[ Fixes ]Fixes and patches
- Security bulletin: Citrix CTX697191Vendor patch or bulletin · CERT-FR · support.citrix.com/support-home/kbsearch/article, cited by CERT-FR CERTFR-2026-AVI-1285
[ Advisories ]Government CERT advisories
-
NCSC-NLNCSC-2026-0410
Vulnerability fixed in Citrix NetScaler ADC and Gateway Translated from Dutch
-
CERT-FRCERTFR-2026-AVI-1285
Vulnerability in Citrix NetScaler ADC and Gateway Translated from French
A vulnerability has been discovered in Citrix NetScaler ADC and Gateway. It allows an attacker to cause remote arbitrary code execution and remote denial of service.
-
BSI CERT-BundWID-SEC-2026-3847
Citrix NetScaler ADC and Gateway: Vulnerability allows code execution and denial of service Translated from German