Citrix Patches Critical NetScaler Flaw That Could Enable RCE in SAML Deployments

Citrix has issued fixes for a critical memory overflow bug, tracked as CVE-2026-107406, affecting NetScaler ADC and NetScaler Gateway. The flaw, rated 9.5 on the CVSS scale, can lead to remote code execution or denial-of-service when a device is set up as a SAML identity provider or service provider, including Secure Private Access Hybrid deployments built on NetScaler. Citrix says there's currently no sign of in-the-wild abuse and credits researchers from JPMorgan Chase's XOR Team along with Maxim Suhanov for the find. Affected builds span multiple 14.1 and 13.1 branches (plus FIPS variants); customers should move to NetScaler ADC/Gateway 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS, or 13.1-37.283 FIPS/NDcPP or later. This comes alongside separate NetScaler vulnerabilities — CVE-2026-88771, CVE-2026-88772, and CVE-2026-88779 — that attackers are already actively exploiting.