---
id: CVE-2026-107406
title: >-
  Memory overflow vulnerability leading to Remote Code Execution or Denial of
  Service Vulnerability in NetScaler ADC.



  NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML
  IdP, subject to the following version-specif…
summary: >-
  Memory overflow vulnerability leading to Remote Code Execution or Denial of
  Service Vulnerability in NetScaler ADC.



  NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML
  IdP, subject to the following version-specif…
severity: critical
cwe:
  - CWE-119
published: '2026-10-08'
updated: '2026-10-10'
sourceUpdated: '2026-10-10T04:18:09.503'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-107406'
references:
  - url: >-
      https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697191
    label: 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5
  - url: >-
      https://community.citrix.com/techzone-blogs/110_security-updates/protecting-customers-immediate-guidance-for-cve-2026-107406-in-netscaler-adc-and-netscaler-gateway-r1631/
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - exploit-available
  - cve.org
epss: 0.01874
epssPercentile: 0.79265
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/techupdate24/citrix-netscaler-rce-cve-2026-107406'
  checkedAt: '2026-10-27T16:55:16.481Z'
exploitAvailable: true
ingestedAt: '2026-10-08T23:16:47.388Z'
vendor: NetScaler
product: ADC
affected:
  - ADC < 14.1-73.46
  - ADC < 13.1-64.29
  - ADC < 14.1-73.46 FIPS
  - ADC < 13.1.37.283 FIPS
  - Gateway < 14.1-73.46
  - Gateway < 13.1-64.29
cvss: 9.5
cvssVector: 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-09T00:00:00+00:00'
cvssSource: cna
---

## Overview

Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC.


NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements:



 

  *  For the following versions: Applicable only when configured as a SAML IdP:
  *  NetScaler ADC and NetScaler Gateway between 14.1-73.37 and 14.1-73.41, inclusive
  *  NetScaler ADC 14.1-FIPS between 14.1-73.37 FIPS and 14.1-73.41 FIPS, inclusive
  *  NetScaler ADC and NetScaler Gateway between 13.1-64.23 and 13.1-64.28, inclusive
  *  NetScaler ADC 13.1-FIPS between 13.1-NDcPP 13.1-37.279 and 13.1- 37.282, inclusive




 



For the following versions: Applicable only when configured as a SAML SP or SAML IdP:

  *  NetScaler ADC and NetScaler Gateway before 14.1-73.37 
  *  NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS 
  *  NetScaler ADC and NetScaler Gateway before 13.1-64.23
  *  NetScaler ADC 13.1-FIPS before13.1-NDcPP 13.1-37.279

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.