On October 5 we flagged the NetScaler SAML flaws that were already being exploited. If you patched then, you are probably not done. Citrix published a new bulletin on October 8 for CVE-2026-107406, a memory overflow in NetScaler ADC and Gateway that can lead to remote code execution, and the fixed builds are newer than the ones from late September.
CISA updated its NetScaler alert on October 9 to add the new CVE and to urge patching of the whole set.
If you patched NetScaler last week, check the build number again. The fix moved.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Citrix adds a tenth NetScaler bug, again in SAML
CVE-2026-107406 (CWE-119, CVSS 4.0 score 9.5) affects customer-managed NetScaler ADC and Gateway configured as a SAML service provider or SAML identity provider. Citrix rates it critical and credits researchers from the JPMorgan Chase XOR Team. The bulletin does not report exploitation.
Some builds released for the September flaws are still affected when the appliance is a SAML IdP: 14.1-73.37 through 14.1-73.41 and 13.1-64.23 through 13.1-64.28. Earlier builds are affected as either SP or IdP.
NetScaler boxes set up as a SAML SP or IdP
SAML is how many companies put single sign-on in front of NetScaler Gateway, so a lot of appliances will match. CISA’s alert says the September bugs CVE-2026-88771 and CVE-2026-88772 are being exploited globally, and that CVE-2026-88779 can be used to force a reboot that helps code planted through CVE-2026-88771 run.
Secure Private Access hybrid deployments that use NetScaler instances are also affected. Citrix-managed cloud services are being upgraded by Citrix.
Move to 14.1-73.46 or 13.1-64.29
- Run
show running-configand look foradd authentication samlAction(SP) oradd authentication samlIdPProfile(IdP). - If either is present, upgrade to 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS or 13.1-37.283 (FIPS/NDcPP) or later.
- Because the September flaws were exploited before patches existed, follow Citrix’s compromise guidance for any appliance that was exposed before you patched.
Forward this
For whoever owns NetScaler: Citrix released another critical fix on October 8, and builds from the September patch round are still affected if the box does SAML sign-in. Can we confirm we are on 14.1-73.46 or 13.1-64.29 or later?
Details
- Bulletin: CTX697191, published October 8, 2026.
- CVE: CVE-2026-107406, memory overflow leading to RCE or denial of service; CVSS 4.0 9.5.
- Fixed: 14.1-73.46+, 13.1-64.29+, 14.1-73.46 FIPS+, 13.1-FIPS / 13.1-NDcPP 13.1-37.283+.
- Related: CVE-2026-88771 and CVE-2026-88772 (KEV, September 27); CVE-2026-88779 (KEV, October 4). CISA alert last revised October 9, 2026.
Hunt / verify
- Unexpected NetScaler reboots since late September. CISA says CVE-2026-88779 can be used to force one.
- Admin accounts in the running config that nobody on your team created.
- Any indicators in Citrix’s compromise guidance for the September CVEs, checked on every appliance that was exposed before it was patched.
Slack paste: NetScaler CVE-2026-107406 (CTX697191, Oct 8, CVSS 9.5): SAML SP/IdP configs. Some September fixed builds still affected as IdP. Action: grep config for samlAction / samlIdPProfile, upgrade to 14.1-73.46 or 13.1-64.29+.
Sources
- Citrix: NetScaler ADC and NetScaler Gateway security bulletin for CVE-2026-107406 (CTX697191)
- CISA: Critical zero-day vulnerabilities exploited in Citrix NetScaler ADC, Gateway (updated October 9, 2026)
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
