CVE-2026-107406: 
Citrix ADC VPX Análisis y mitigación de vulnerabilidades

CVE-2026-107406 is a memory overflow vulnerability in Citrix NetScaler ADC and NetScaler Gateway that can lead to Remote Code Execution (RCE) or Denial of Service (DoS) when the appliance is configured as a SAML Service Provider (SP) or SAML Identity Provider (IdP). Disclosed on October 8, 2026, it affects NetScaler ADC and Gateway versions before 13.1-64.29 and before 14.1-73.46, as well as corresponding FIPS variants. The vulnerability carries a CVSS v4.0 base score of 9.5 (Critical) (GitHub Advisory, Citrix Advisory).

The vulnerability is a memory overflow (buffer overflow) in the SAML authentication processing component of NetScaler ADC and Gateway. It is exploitable remotely without authentication or user interaction, though attack complexity is rated High, suggesting some non-trivial conditions must be met (e.g., specific SAML configuration). The scope of exploitation differs by version: older versions (before 14.1-73.37 and before 13.1-64.23) are vulnerable when configured as either SAML SP or SAML IdP, while intermediate versions (14.1-73.37 through 14.1-73.41 and 13.1-64.23 through 13.1-64.28) are only vulnerable when configured as a SAML IdP. No CWE classification has been formally assigned, and no public proof-of-concept code has been identified (GitHub Advisory, Citrix Advisory).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code on the affected NetScaler ADC or Gateway appliance, or cause it to crash and become unavailable (DoS). Given that NetScaler ADC and Gateway are typically deployed as network access control and authentication gateways, a compromise could expose internal network resources, enable lateral movement into enterprise environments, and potentially allow interception or manipulation of authentication flows for downstream systems (GitHub Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is 0.0, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack complexity is rated High, which may limit opportunistic exploitation, but the critical severity and unauthenticated attack vector make it a high-priority patching target (GitHub Advisory, Feedly).

Citrix has released patched versions and urges immediate upgrade. The fixed versions are:

• NetScaler ADC and Gateway: 13.1-64.29 or later; 14.1-73.46 or later
• NetScaler ADC 14.1-FIPS: 14.1-73.46 FIPS or later
• NetScaler ADC 13.1-FIPS: 13.1.37.283 FIPS or later

For systems that cannot be immediately patched, administrators should disable SAML SP or SAML IdP functionality if not operationally required, and implement network-level access controls to restrict traffic to NetScaler management interfaces. Upgrading to a patched version is the recommended long-term solution (Citrix Advisory, GitHub Advisory).

The vulnerability received rapid coverage across the security community following its October 8, 2026 disclosure. Citrix published immediate guidance via its community TechZone blog urging customers to patch without delay (Citrix Community). Security researcher Kevin Beaumont (GossiTheDog) commented on the vulnerability via Mastodon, and outlets including BleepingComputer, The Hacker News, SecurityWeek, and GBHackers published coverage emphasizing the critical severity and the need for immediate patching (BleepingComputer, The Hacker News, SecurityWeek). Community discussion on Reddit's r/Citrix also highlighted urgency for enterprise administrators managing SAML-configured deployments.