CVE-2026-107406: 
Citrix ADC VPX vulnerability analysis and mitigation

CVE-2026-107406 is a memory overflow vulnerability in Citrix NetScaler ADC and NetScaler Gateway that can lead to Remote Code Execution (RCE) or Denial of Service (DoS) when the appliance is configured as a SAML Service Provider (SP) or SAML Identity Provider (IdP). It was published on October 8, 2026, with patches and advisories released on October 9, 2026. Affected versions include NetScaler ADC and Gateway before 14.1-73.46 and before 13.1-64.29, as well as NetScaler ADC 14.1-FIPS before 14.1-73.46 FIPS and 13.1-FIPS before 13.1.37.283 FIPS; notably, versions 14.1-73.37 through 14.1-73.41 and 13.1-64.23 through 13.1-64.28 are only vulnerable when configured as a SAML IdP, while older versions are vulnerable in both SAML SP and IdP configurations. The vulnerability carries a CVSS v4.0 base score of 9.5 (Critical) (GitHub Advisory, Feedly).

The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), where the SAML processing component in NetScaler ADC/Gateway fails to properly validate or bound-check memory operations, resulting in a memory overflow condition (GitHub Advisory). The attack vector is network-based, requiring no authentication (Privileges Required: None) and no user interaction, though attack complexity is rated High, suggesting some non-trivial precondition or variability in exploitation — specifically, the target must be configured as a SAML SP or SAML IdP (Feedly). An unauthenticated remote attacker can send a crafted SAML request to trigger the overflow, potentially redirecting execution flow to attacker-controlled code or crashing the NetScaler process. A technical deep-dive dissecting the CVSS 9.5 SAML SP/IdP RCE and DoS mechanics has been published by security researchers (sh3llc0d3 Blog).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code as the NetScaler process, achieving full compromise of the affected appliance, or to crash the service causing a denial of service. Given that NetScaler ADC and Gateway are commonly deployed as network access control and application delivery points, a compromised appliance could expose internal networks to lateral movement, enable interception of authentication traffic (including SAML tokens and credentials), and disrupt access to enterprise applications for all users. The CVSS v4.0 subsequent system impact metrics rate both confidentiality and integrity as High, reflecting the potential for downstream impact beyond the directly vulnerable system (GitHub Advisory, Feedly).

A GitHub repository claiming to contain a PoC exploit was identified, but Feedly's analysis assessed it as a fake claim — the repository contained only a README with no exploit code, reproduction steps, or technical details (Feedly). Despite the absence of a confirmed working public exploit, exploitation has been reported in the wild, with CISA urging immediate patching and BeyondMachines reporting active exploitation of Citrix NetScaler vulnerabilities in this timeframe (BeyondMachines). The EPSS score is approximately 0.41–0.47%, placing it in the 39th percentile for exploitation probability within 30 days (GitHub Advisory). No specific threat actor attribution has been publicly confirmed for this CVE at time of writing.

1. Reconnaissance: Identify internet-facing NetScaler ADC or Gateway appliances using tools like Shodan or Censys, filtering for versions prior to 14.1-73.46 or 13.1-64.29. Confirm SAML SP or IdP configuration by probing SAML-related endpoints (e.g., /saml/login, /cgi/samlauth).
2. Craft malicious SAML request: Construct an oversized or malformed SAML request (e.g., an AuthnRequest or Response) designed to trigger a memory overflow in the NetScaler SAML parsing component. The payload must be crafted to overflow a memory buffer in the SAML processing code path.
3. Deliver the payload: Send the crafted SAML request to the target appliance's SAML endpoint without any authentication. The attack requires no prior credentials or user interaction.
4. Trigger memory corruption: The malformed SAML data causes the NetScaler process to write beyond the intended memory buffer boundary (CWE-119), corrupting adjacent memory structures.
5. Achieve RCE or DoS: Depending on exploit precision and memory layout, the attacker either redirects execution to attacker-controlled shellcode/ROP chain (RCE) or causes the NetScaler process to crash (DoS), disrupting all services on the appliance (GitHub Advisory, sh3llc0d3 Blog).

• Network: Unusual or malformed HTTP POST requests to SAML endpoints (e.g., /saml/login, /cgi/samlauth) from unexpected source IPs; oversized SAML request bodies or anomalous XML payloads in SAML traffic; unexpected outbound connections from the NetScaler appliance to external IPs.
• Logs: NetScaler ns.log or /var/log/ns.log entries showing crashes or restarts of the nsppe, nsnetsvc, or related SAML processing daemons; error messages referencing memory faults or segmentation violations in SAML processing; repeated failed or malformed SAML authentication attempts from a single source.
• Process/System: Unexpected process crashes or core dumps on the NetScaler appliance; new or unexpected processes spawned by NetScaler service accounts; unusual files written to /var/nslog/ or /tmp/ directories.
• File System: Presence of web shells or unexpected scripts in NetScaler web directories; modification timestamps on system binaries inconsistent with patch history.
• Availability: Sudden service unavailability or repeated restarts of the NetScaler SAML service without administrative action (Feedly, sh3llc0d3 Blog).

Citrix has released patched versions that should be applied immediately: NetScaler ADC and Gateway 14.1-73.46 or later, NetScaler ADC and Gateway 13.1-64.29 or later, NetScaler ADC 14.1-FIPS 14.1-73.46 FIPS or later, and NetScaler ADC 13.1-FIPS 13.1.37.283 FIPS or later (GitHub Advisory, Feedly). As a temporary workaround if immediate patching is not possible, administrators should disable SAML SP or SAML IdP functionality on the appliance until patches can be applied. Organizations should also monitor for exploitation attempts targeting SAML endpoints and review access logs for anomalous SAML traffic. The Citrix community blog provides immediate guidance for affected customers (Citrix Community).

The vulnerability generated significant attention across the security community, with coverage from major outlets including BleepingComputer, The Hacker News, The Register, SecurityWeek, and Heise, all urging immediate patching (BleepingComputer, The Hacker News, SecurityWeek). Prominent security researchers including Kevin Beaumont (GossiTheDog) commented on the vulnerability via Mastodon, and the infosec community on platforms like Reddit, Mastodon, and Bluesky widely shared the advisory. CISA issued an alert urging customers to patch, and national CERTs including Canada's CCCS, Ireland's NCSC, Singapore's CSA, and the UK's NHS Digital all published advisories (CISA Alert). The CyCognito and SOC Prime teams published threat intelligence blogs, and a checker tool for the related CTX697096 advisory was released on GitHub, reflecting active community response (CyCognito Blog).