---
title: NetScaler CVE-2026-107406 (CVSS 9.5): SAML memory overflow also hits builds that fixed last week's KEV bug | ctxsec
url: https://ctxsec.com/items/netscaler-cve-2026-107406
description: ""
status: "confirmed (vendor), no known exploitation, not on KEV"
published: 2026-10-08
---

> 

[← Cybersecurity News](/news) · [markdown](/items/netscaler-cve-2026-107406.md)

confirmed (vendor), no known exploitation, not on KEV

2026-10-08

### NetScaler CVE-2026-107406 (CVSS 9.5): SAML memory overflow also hits builds that fixed last week's KEV bug

Citrix bulletin CTX697191 (Oct 8): memory overflow leading to RCE or DoS when NetScaler ADC/Gateway is configured as a SAML SP or IdP (CVSS v4 9.5). Builds 14.1-73.37 to 73.41 and 13.1-64.23 to 64.28 (the fixes for KEV-listed CVE-2026-88779) are still affected when acting as a SAML IdP; older builds are affected as SP or IdP. Fixed: 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS, 13.1-37.283 FIPS/NDcPP. Citrix said it was not aware of unmitigated exploits at publication; CISA added it to its NetScaler alert on Oct 9, but it is not on KEV. Some X posts call it exploited; we found no primary confirmation. NetScaler already has four KEV entries since Sept 9 (CVE-2026-19490, -88771, -88772, -88779).

Sources: [Citrix bulletin CTX697191](https://support.citrix.com/external/article/CTX697191/citrix-netscaler-adc-and-citrix-netscale.html) · [Citrix guidance blog](https://community.citrix.com/techzone-blogs/110_security-updates/protecting-customers-immediate-guidance-for-cve-2026-107406-in-netscaler-adc-and-netscaler-gateway-r1631/) · [CISA alert (updated Oct 9)](https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway) · [CVE-2026-107406](https://www.cve.org/CVERecord?id=CVE-2026-107406)