Citrix Patches Critical Memory Overflow in NetScaler ADC and Gateway

Citrix has released security updates to address a critical memory overflow vulnerability in its NetScaler ADC and NetScaler Gateway products. The flaw, tracked as CVE-2026-107406, carries a CVSS score of 9.5 and can lead to remote code execution or denial of service under specific configuration conditions.

According to SecurityWeek, Citrix is urging customers to patch immediately. The National Vulnerability Database describes the issue as a memory overflow vulnerability. The Hacker News reports that Citrix confirmed the defect could result in remote code execution or denial-of-service attacks. The vulnerability is exploitable only when the affected NetScaler components are configured to handle Security Assertion Markup Language (SAML) traffic, either as a Service Provider (SP) or an Identity Provider (IdP).

Vulnerability Details and Scope

The memory overflow occurs within the SAML processing logic of the NetScaler platform. Successful exploitation requires the target system to be actively handling SAML assertions. This means organizations that use NetScaler purely for load balancing or basic web application firewalling, without SAML integration, are not exposed to this specific threat vector. However, for enterprises relying on NetScaler for single sign-on (SSO) authentication flows, the risk is significant given the high severity rating.

The National Vulnerability Database lists the CVSS score as 9.5, categorizing the severity as critical. This rating reflects the potential for an unauthenticated attacker to execute arbitrary code on the server or crash the service, leading to a denial of service. The specific mechanics involve a buffer overflow during the processing of SAML data, which allows an attacker to overwrite memory and control the execution flow.

Affected Versions

The vulnerability impacts a wide range of NetScaler ADC and NetScaler Gateway versions, with specific constraints based on SAML configuration roles.

For systems configured strictly as a SAML Identity Provider, the following versions are affected:

• NetScaler ADC and NetScaler Gateway versions 14.1-73.37 through 14.1-73.41, inclusive.
• NetScaler ADC 14.1-FIPS versions 14.1-73.37 FIPS through 14.1-73.41 FIPS, inclusive.
• NetScaler ADC and NetScaler Gateway versions 13.1-64.23 through 13.1-64.28, inclusive.
• NetScaler ADC 13.1-FIPS versions 13.1-NDcPP 13.1-37.279 through 13.1-37.282, inclusive.

For systems configured as either a SAML Service Provider or a SAML Identity Provider, the following versions are affected:

• NetScaler ADC and NetScaler Gateway versions prior to 14.1-73.37.
• NetScaler ADC 14.1-FIPS versions prior to 14.1-73.37 FIPS.
• NetScaler ADC and NetScaler Gateway versions prior to 13.1-64.23.
• NetScaler ADC 13.1-FIPS versions prior to 13.1-NDcPP 13.1-37.279.

Citrix has provided patches for NetScaler ADC versions prior to 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS, and 13.1.37.283 FIPS. NetScaler Gateway users should update to versions prior to 14.1-73.46 and 13.1-64.29 to mitigate the risk.

What should you do?

Organizations should verify their NetScaler ADC and Gateway configurations to determine if SAML is enabled. If SAML is in use, administrators must check their current version against the affected list provided by Citrix. Immediate application of the latest security patches is recommended for all affected systems. Until patches are applied, consider restricting access to the SAML endpoints or implementing network-level controls to limit exposure to untrusted sources.