Swiss SME Cyber Alert: Citrix NetScaler – new critical SAML fix required
Updated: Oct 11
Citrix has disclosed another critical SAML vulnerability in NetScaler ADC and NetScaler Gateway. Under certain SAML configurations, CVE-2026-107406 can allow unauthenticated code execution or a service outage on customer-managed appliances; builds installed after the late-September warning may still be affected. If your organisation uses NetScaler, ask your IT provider to recheck the SAML configuration and confirm the new fixed release now.
What happened?
Citrix published its security bulletin for CVE-2026-107406 on 8 October 2026 and updated it on 9 October. A memory overflow in NetScaler ADC and NetScaler Gateway can lead to remote code execution or denial of service when the relevant SAML configuration is present. Citrix rates the vulnerability CVSS v4.0 9.5.
This matters because builds installed in response to the NetScaler vulnerabilities reported and actively exploited in late September can also be affected. CVE-2026-107406 is an additional flaw with newer fixed releases.
Could my company be affected?
Yes, if your company or IT provider runs a customer-managed NetScaler ADC or NetScaler Gateway appliance and uses SAML for authentication. Secure Private Access Hybrid deployments that use NetScaler are also in scope.
Citrix-managed cloud services have already been updated by the vendor. Customer-managed appliances must be checked again. If the name is unfamiliar, ask your IT provider specifically about Citrix NetScaler or its former name, Citrix ADC.
What should you do now?
Ask your IT provider promptly to identify every customer-managed Citrix NetScaler system and its SAML configuration.
Have them confirm that each appliance is running at least 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS or 13.1-37.283 for FIPS/NDcPP.
Systems upgraded in late September to 14.1-73.37 or 13.1-64.23 must be checked again when configured as a SAML IdP and upgraded where necessary.
How urgent is it?
High. Under the stated conditions, the new vulnerability can be reached over the network without valid credentials and may lead to code execution. Citrix was not aware of unmitigated exploits for CVE-2026-107406 when it published the bulletin, but the impact and the revised fixed releases justify action outside the normal maintenance cycle.
The previously covered SAML flaw CVE-2026-88779 continues to be actively exploited. This new advisory does not replace that risk; it expands the required review.
Information for your IT provider
CVE-2026-107406, CVSS v4.0 9.5: memory overflow with possible remote code execution or denial of service; network attack with no user interaction and high attack complexity.
Affected when configured as a SAML IdP: NetScaler 14.1-73.37 through 14.1-73.41 and 13.1-64.23 through 13.1-64.28; corresponding FIPS ranges 14.1-73.37 through 14.1-73.41 and 13.1-37.279 through 13.1-37.282.
Earlier builds before those ranges are affected when NetScaler is configured as either a SAML SP or SAML IdP.
Fixed releases: 14.1-73.46 or later; 13.1-64.29 or later; 14.1-73.46 FIPS or later; 13.1-37.283 FIPS/NDcPP or later.
Configuration checks specified by Citrix: SAML SP via “add authentication samlAction”; SAML IdP via “add authentication samlIdPProfile”. Only customer-managed appliances are affected.
