CVE-2026-107406 in ADC
Summary
by MITRE • 10/09/2026
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC.
NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements:
* For the following versions: Applicable only when configured as a SAML IdP: * NetScaler ADC and NetScaler Gateway between 14.1-73.37 and 14.1-73.41, inclusive * NetScaler ADC 14.1-FIPS between 14.1-73.37 FIPS and 14.1-73.41 FIPS, inclusive * NetScaler ADC and NetScaler Gateway between 13.1-64.23 and 13.1-64.28, inclusive * NetScaler ADC 13.1-FIPS between 13.1-NDcPP 13.1-37.279 and 13.1- 37.282, inclusive
For the following versions: Applicable only when configured as a SAML SP or SAML IdP:
* NetScaler ADC and NetScaler Gateway before 14.1-73.37 * NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS * NetScaler ADC and NetScaler Gateway before 13.1-64.23 * NetScaler ADC 13.1-FIPS before13.1-NDcPP 13.1-37.279
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
A critical memory overflow vulnerability exists within the Security Assertion Markup Language processing components of Citrix NetScaler Application Delivery Controller and NetScaler Gateway platforms, posing a severe risk to system integrity and availability. This flaw is specifically triggered when the appliance is configured as either a SAML Service Provider or Identity Provider, allowing an unauthenticated attacker to exploit the buffer handling mechanisms during the parsing of maliciously crafted SAML assertions. The vulnerability stems from improper validation of input data lengths relative to allocated memory buffers, leading to a heap-based buffer overflow condition that can be triggered remotely over standard network protocols without requiring prior authentication credentials on the target system.
The technical nature of this flaw involves the failure to properly bound user-supplied data during the processing of SAML XML structures. When an attacker submits specially crafted SAML responses or requests containing oversized fields, the application writes data beyond the boundaries of the allocated memory buffer. This out-of-bounds write operation corrupts adjacent memory regions, which can be manipulated by a skilled adversary to alter program execution flow. Depending on the specific version and configuration context, this corruption allows for arbitrary code execution with the privileges of the affected service account or causes an immediate crash of the processing thread, resulting in a Denial of Service condition that disrupts authentication services for legitimate users.
The operational impact is significant due to the central role NetScaler plays in enterprise identity federation architectures. If exploited successfully as Remote Code Execution, the vulnerability grants attackers full control over the underlying operating system hosting the NetScaler instance, enabling them to pivot into internal networks, exfiltrate sensitive data, or establish persistent backdoors. In scenarios where exploitation leads only to a Denial of Service, the consequence is the disruption of single sign-on capabilities for thousands of users relying on SAML-based authentication through the Citrix gateway, causing substantial business continuity issues and potential revenue loss during outages.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-120, which describes buffer copy without checking size limits, a classic category of memory safety errors often found in C or C++ based network appliances. From an offensive security perspective, the exploitation technique maps to MITRE ATT&CK techniques related to remote code execution via application layer protocols and potentially privilege escalation if the service runs with elevated system rights. The specific attack vector involves sending malformed XML data over HTTPS, which may bypass some basic intrusion detection systems that do not deeply inspect SAML payload structures for buffer overflow indicators.
Mitigation strategies must be implemented immediately by administrators to address this critical risk. Citrix has released updated software versions that include patches for the memory handling logic in the SAML processing engine. Organizations running affected versions of NetScaler ADC and NetScaler Gateway, including specific builds within the 14.1-73.x and 13.1-64.x series as well as their FIPS variants, must upgrade to the latest recommended release that resolves this issue. For environments where immediate patching is not feasible due to operational constraints, temporary mitigations may include restricting access to SAML endpoints via firewall rules or disabling specific SAML features if they are not strictly required for business operations, although these measures do not fully eliminate the risk and should be viewed as interim controls until a permanent software update is applied.