Memory Overflow Vulnerability in NetScaler ADC and Gateway by Citrix
CVE-2026-107406

9.5CRITICAL

Key Information:

Vendor

Netscaler
Status
Adc
Gateway
Vendor
CVE Published:
8 October 2026

Badges

📈 Trended📈 Score: 5,220👾 Exploit Exists🟡 Public PoC📰 News Worthy

What is CVE-2026-107406?

CVE-2026-107406 is a significant memory overflow vulnerability found in the NetScaler ADC (Application Delivery Controller) and NetScaler Gateway products developed by Citrix. These products serve to optimize application performance, secure endpoints, and enable load balancing for various network applications. The vulnerability arises specifically when NetScaler is configured as either a Security Assertion Markup Language (SAML) Service Provider (SP) or Identity Provider (IdP).

When exploited, this memory overflow flaw can lead to Remote Code Execution (RCE) or a Denial of Service (DoS), allowing an attacker to execute arbitrary code on the vulnerable system or overwhelm it to the point of inaccessibility. Given the critical role that NetScaler plays in managing and protecting network traffic, organizations could face severe disruptions, unauthorized data access, and significant operational challenges if this vulnerability is not addressed promptly.

Potential impact of CVE-2026-107406

  1. Remote Code Execution: The vulnerability enables threat actors to take control of affected systems, potentially allowing them to run malicious code that could compromise sensitive data and system integrity.

  2. Denial of Service: The exploit may lead to service outages, impacting the availability of applications and services that rely on NetScaler, thereby disrupting business operations and affecting end-users.

  3. Increased Attack Surface: Organizations utilizing vulnerable versions of NetScaler ADC or Gateway expose themselves to heightened security risks, which can be exploited by cybercriminals for further malicious activities, including data breaches and network infiltration.

Affected Version(s)

ADC 0 < 14.1-73.46

ADC 0 < 13.1-64.29

ADC 0 < 14.1-73.46 FIPS

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-107406
Created by maxprog-svg

News Articles

favicon imageItnews

NetScaler builds that fixed zero-days carry critical flaw, too

Key points Citrix has disclosed CVE-2026-107406, a critical memory overflow in NetScaler ADC and Gateway builds that patched last month's exploited flaws, scoring 9.5 on CVSS v4.0. Appliances configured for...

3 weeks ago

favicon imageBleepingComputer

Citrix warns admins to patch new NetScaler RCE flaw immediately

Citrix has warned IT administrators to patch systems immediately against a new critical vulnerability affecting NetScaler ADC networking appliances and NetScaler Gateway secure remote access solutions.

3 weeks ago

favicon imageThe Hacker News

Citrix Patches Critical NetScaler Flaw That Could Enable RCE in SAML Deployments

Citrix patched CVE-2026-107406, a critical NetScaler memory overflow that could allow RCE or DoS in deployments configured for SAML.

3 weeks ago

References

https://support.citrix.com/support-home/kbsearch/article?...

CVSS V4

Score:
9.5
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 📈

    Vulnerability started trending

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by Securityweek

  • Vulnerability published

  • Vulnerability Reserved

.