Citrix NetScaler · October 8, 2026

Patch Citrix NetScaler for CVE-2026-107406

Citrix rates CVE-2026-107406 Critical (CVSS 4.0: 9.5) and describes a memory-overflow vulnerability that can lead to remote code execution or denial of service. The affected SAML role depends on the exact release: some intermediate builds are affected only when configured as an identity provider (IdP), while earlier builds are affected as either an IdP or service provider (SP).

Upgrade to the fixed release for your product track. Do not treat the CVE-2026-88779 fixed builds (such as 14.1-73.41 or 13.1-64.28) as sufficient for CVE-2026-107406: Citrix lists those builds within this CVE’s affected ranges when the appliance is configured as a SAML IdP. The advisory does not establish active exploitation; check current Citrix and government advisories for status changes. Citrix's bulletin does not report observed exploitation. NHS England assesses exploitation as likely, citing mass exploitation of recent NetScaler flaws after public proof-of-concept releases; its alert does not report observed exploitation of this CVE. On 12 October, NHS England corrected its affected-platform list to include 14.1-73.41, 13.1-64.28, and the corresponding FIPS builds.

Affected build range	SAML role required by Citrix	Minimum fixed build
ADC/Gateway 14.1 before 14.1-73.37	SAML SP or SAML IdP	14.1-73.46 or later
ADC/Gateway 14.1-73.37 through 14.1-73.41, inclusive	SAML IdP only	14.1-73.46 or later
ADC/Gateway 13.1 before 13.1-64.23	SAML SP or SAML IdP	13.1-64.29 or later
ADC/Gateway 13.1-64.23 through 13.1-64.28, inclusive	SAML IdP only	13.1-64.29 or later
ADC 14.1-FIPS before 14.1-73.37 FIPS	SAML SP or SAML IdP	14.1-73.46 FIPS or later
ADC 14.1-FIPS 14.1-73.37 FIPS through 14.1-73.41 FIPS, inclusive	SAML IdP only	14.1-73.46 FIPS or later
ADC 13.1-FIPS/NDcPP before 13.1-37.279	SAML SP or SAML IdP	13.1.37.283 or later
ADC 13.1-FIPS/NDcPP 13.1-37.279 through 13.1-37.282, inclusive	SAML IdP only	13.1.37.283 or later

Check SAML configuration and build

Citrix identifies SAML SP configuration with `add authentication samlAction` and SAML IdP configuration with `add authentication samlIdPProfile`. Compare the running configuration and exact product build against the table; do not apply the IdP-only condition to the earlier version ranges. The bulletin covers customer-managed ADC and Gateway appliances, including Secure Private Access Hybrid deployments that use NetScaler instances. Citrix-managed cloud services are updated by Cloud Software Group.

Step 1

Identify the product track

Record whether each appliance is ADC or Gateway, its standard/FIPS/NDcPP track, and its exact build.

Step 2

Determine the SAML role

Check for `add authentication samlAction` (SP) and `add authentication samlIdPProfile` (IdP).

Step 3

Apply the matching condition

For builds in the intermediate ranges, Citrix says only SAML IdP configuration is affected; for earlier ranges, either SAML role is in scope.

Step 4

Upgrade and verify

Install the fixed build listed for the same release track, then verify the installed version on every appliance and high-availability peer.

Inventory customer-managed NetScaler ADC/Gateway appliances and Secure Private Access Hybrid NetScaler instances.
Record the exact standard, FIPS, or NDcPP build and inspect the effective configuration for both SAML commands.
Use the version-specific SAML-role condition in Citrix bulletin CTX697191; an IdP-only result applies only to the listed intermediate ranges.
Upgrade affected appliances to 14.1-73.46+, 13.1-64.29+, 14.1-73.46 FIPS+, or 13.1.37.283+ for the FIPS/NDcPP branches, as applicable.
Verify the installed fixed build on each appliance and HA peer, then test SAML login and failover through the normal change process.
Recheck the current vendor advisory for changes to exploitation status or remediation guidance; this page does not infer either from the CVSS score.

Citrix security bulletin CTX697191 → NHS England threat update, 12 Oct 2026 → Related: CVE-2026-88779 SAML denial of service → Related: September NetScaler patch guide → Browse the security directory →