CVE-2026-107406: Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC. NetScaler ADC or NetScaler Gateway must be…

PriorityP264critical9.5CVSS 4.0

AVNACHATNPRNUINVCHVIHVAHSCHSIHSALEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX

EPSS

1.87%

79.2th percentile

Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC.


NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements:




* For the following versions: Applicable only when configured as a SAML IdP:
* NetScaler ADC and NetScaler Gateway between 14.1-73.37 and 14.1-73.41, inclusive
* NetScaler ADC 14.1-FIPS between 14.1-73.37 FIPS and 14.1-73.41 FIPS, inclusive
* NetScaler ADC and NetScaler Gateway between 13.1-64.23 and 13.1-64.28, inclusive
* NetScaler ADC 13.1-FIPS between 13.1-NDcPP 13.1-37.279 and 13.1- 37.282, inclusive





For the following versions: Applicable only when configured as a SAML SP or SAML IdP:

* NetScaler ADC and NetScaler Gateway before 14.1-73.37
* NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS
* NetScaler ADC and NetScaler Gateway before 13.1-64.23
* NetScaler ADC 13.1-FIPS before13.1-NDcPP 13.1-37.279

Affected

15 ranges

Vendor	Product	Version range	Fixed in
citrix	citrix_adm	—	—
citrix	citrix_endpoint_management	—	—
citrix	citrix_netscaler_adc	—	—
citrix	citrix_netscaler_gateway	—	—
citrix	citrix_virtual_apps_and_desktops	—	—
citrix	citrix_workspace_app	—	—
citrix	endpoint_management	—	—
citrix	xenmobile	—	—
citrix	xenserver	—	—
netscaler	adc	< 14.1-73.46	14.1-73.46
netscaler	adc	< 13.1-64.29	13.1-64.29
netscaler	adc	< 14.1-73.46 FIPS	14.1-73.46 FIPS
netscaler	adc	< 13.1.37.283 FIPS	13.1.37.283 FIPS
netscaler	gateway	< 14.1-73.46	14.1-73.46
netscaler	gateway	< 13.1-64.29	13.1-64.29

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.