Citrix is urging administrators to update NetScaler ADC and NetScaler Gateway appliances after disclosing a critical memory-overflow vulnerability that can lead to remote code execution or denial of service. The issue, tracked as CVE-2026-107406, received a CVSS 4.0 score of 9.5 and is documented in Citrix bulletin CTX697191.

The vulnerability is especially important for organizations that place NetScaler systems at the edge of their networks for application delivery and authentication. An exposed gateway is not simply another server: it may sit directly in the path used by employees and partners to reach sensitive services. Citrix said it was not aware of unmitigated exploitation when it published the advisory, but defenders should not treat that statement as a reason to delay remediation.

Exposure Depends on the SAML Role and Installed Build

CVE-2026-107406 is categorized as CWE-119, a failure to properly restrict memory-buffer operations. Citrix says a successful network attack could execute code or interrupt service without requiring an authenticated account or user interaction. The attack complexity is rated high, and the vendor has not released exploit details.

Determining exposure requires more than checking the major NetScaler version. On branches 14.1 and 13.1, several recent build ranges are vulnerable only when the appliance is configured as a SAML identity provider. Older supported builds can be exposed when operating as either a SAML identity provider or a SAML service provider. FIPS and NDcPP releases have their own affected thresholds.

Administrators can inspect configuration entries for add authentication samlIdPProfile, which indicates an identity-provider role, and add authentication samlAction, which identifies a service-provider configuration. Those entries must then be evaluated alongside the exact installed build. An inventory that records only “NetScaler 14.1” is not detailed enough for this decision.

Fixed Releases Are Available Across Supported Branches

Citrix recommends moving NetScaler ADC and Gateway systems to version 14.1-73.46 or later on the 14.1 branch, or 13.1-64.29 or later on the 13.1 branch. Customers using 14.1-FIPS should install 14.1-73.46 FIPS or newer. The fixed level for 13.1-FIPS and NDcPP is 13.1-37.283 or later.

Secure Private Access Hybrid environments that rely on affected customer-managed NetScaler instances also need attention. Citrix-managed cloud services and Citrix-managed Adaptive Authentication are maintained by the vendor and are outside the customer-managed appliance scope described in the bulletin.

Recent NetScaler security incidents make version discipline particularly important. Applying an earlier emergency patch does not necessarily protect an appliance from this newly disclosed flaw. Teams should use CTX697191 as the authoritative reference, confirm their branch and SAML role, and select the fixed build specified for that combination.

What Security Teams Should Do Now

• Build an inventory of internet-facing and internally deployed NetScaler ADC and Gateway instances.
• Record the complete build number and whether each system acts as a SAML identity provider, service provider, or both.
• Upgrade to the applicable fixed release and confirm that the new version remains installed after reboot or failover.
• Review administrative changes, crashes, unusual child processes, and unexpected authentication behavior around exposed appliances.
• Restrict management interfaces and preserve logs before remediation if suspicious activity is found.

Because the flaw can affect a device at a high-trust network boundary, patching should be paired with investigation rather than treated as a purely operational upgrade. If telemetry suggests compromise, responders should consider credentials and sessions passing through the gateway potentially exposed, isolate the device where feasible, and follow Citrix’s incident guidance. After updating, teams should test authentication flows and high-availability pairs so that emergency remediation does not leave a silent service or failover gap. The absence of a public exploit at disclosure lowers immediate evidence of mass abuse, but it does not reduce the consequence of a successful attack.