Citrix patches critical NetScaler SAML flaw CVE-2026-107406

Citrix patched CVSS 9.5 NetScaler flaw CVE-2026-107406, which can enable RCE or DoS on SAML setups, with no known exploitation.

On October 9, 2026, Citrix patched CVE-2026-107406, a CVSS 9.5 memory-overflow flaw (CWE-119) in NetScaler ADC and NetScaler Gateway that can allow remote code execution or denial of service when the appliance is configured as a SAML identity provider or service provider. The Register says the affected SAML configurations depend on the build, and Secure Private Access Hybrid deployments using affected NetScaler instances also require updates. Recommended fixes include 14.1-73.46 and later and 13.1-64.29 and later, plus specified FIPS and NDcPP releases; Canada's Cyber Centre advisory AV26-1023 lists builds before 13.1-64.29 and 14.1-73.46 and FIPS builds before 14.1-73.46 FIPS and 13.1-37.283 FIPS. Citrix and the outlets say they know of no exploitation of this bug, which JPMorgan Chase's XOR Team and Maxim Suhanov were credited with finding. Sources disagree on older issues: The Hacker News says CVE-2026-88771, CVE-2026-88772, and CVE-2026-88779 are already exploited; Security Affairs confirms exploitation of the first two and says CISA added DoS flaw CVE-2026-88779 to the KEV catalog; The Register says CVE-2026-88772 has been targeted since at least early September and that CVE-2026-88779 was exploited. BleepingComputer adds that other NetScaler flaws were abused earlier in 2026 and that Shadowserver tracks more than 21,000 exposed NetScaler IPs.