This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Citrix fixes a critical vulnerability

Citrix fixes a critical vulnerability in NetScaler ADC and NetScaler Gateway. Only devices using SAML are vulnerable, and the specific affected versions differ depending on whether they are configured as a service provider (SP) or an identity provider (IdP). Details are available at [1]. Products and their fixed versions [1]: Citrix NetScaler ADC - 13.1-37.283 FIPS, 13.1-37.283 NDcPP, 13.1-64.29, 14.1-73.46, 14.1-73.46 FIPS Citrix NetScaler Gateway - 13.1-64.29, 14.1-73.46

NetScaler ADC, NetScaler Gateway - RCE (CVE-2026-107406)
CVSS 9.5 (Critical)

An unauthenticated remote attacker can, under a certain configuration, execute arbitrary code or cause a DoS attack due to a memory overflow [1].

The vulnerability is present in products:

  • Citrix NetScaler ADC; >=13.1 FIPS, <13.1-37.283 FIPS; >=13.1 NDcPP, <13.1-37.283 NDcPP; >=13.1, <13.1-64.29; >=14.1, <14.1-73.46; >=14.1 FIPS, <14.1-73.46 FIPS
  • Citrix NetScaler Gateway; >=13.1, <13.1-64.29; >=14.1, <14.1-73.46

CVSS: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L

More information:

  • CVE-2026-107406 at cve.org, NVD
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer at cwe.mitre.org

The vulnerability was publicly disclosed 8. 10. 2026.

By CESNET, z.s.p.o. Henrieta Paločková on 12. 10. 2026.

CESNET, z.s.p.o. Logo