Citrix NetScaler SAML Flaw CVE-2026-107406 Enables RCE and DoS

Key points

• Citrix NetScaler ADC and Gateway contain a memory overflow bug tracked as CVE-2026-107406.
• Exploitation can cause remote code execution or denial-of-service.
• The issue affects SAML authentication deployments.
• Citrix issued an advisory with patching instructions in 2026.
• Severity is rated medium, but edge exposure raises risk.

Citrix released a security advisory in 2026 addressing a medium-severity vulnerability tracked as CVE-2026-107406. The flaw affects NetScaler ADC and NetScaler Gateway, specifically when these products handle SAML authentication traffic. The vendor reports that specific SAML procedures may cause a memory overflow, which could enable remote code execution or a denial-of-service attack.

Because SAML is a widely used protocol for single sign-on, many organizations have deployed these Citrix appliances at the network edge to broker authentication between identity providers and internal applications. That exposure makes the bug relevant to K-12 districts, government agencies, and any entity relying on SAML-based access. An attacker who successfully exploits the overflow could crash the service or, in a worst-case scenario, execute arbitrary commands on the affected system.

The medium rating reflects that exploitation likely requires specific conditions, but the potential outcomes are severe. Remote code execution on an authentication gateway can lead to credential theft, lateral movement, and full compromise of downstream resources. Denial-of-service, meanwhile, can lock out students, staff, and administrators during critical periods.

Citrix has provided patching guidance in its advisory. Administrators should treat this as an urgent maintenance item, not a routine update. There is no indication of active exploitation yet, but proof-of-concept code often follows public disclosure. Watch for vendor updates, threat intelligence reports, and anomalous SAML requests or crashes in NetScaler logs.

What to do now

1. Inventory all NetScaler ADC and NetScaler Gateway instances, prioritizing those with SAML configured and internet-facing management interfaces.
2. Apply the patch referenced in Citrix's advisory immediately; schedule emergency maintenance if needed.
3. If patching cannot be done right away, disable SAML on affected appliances or restrict access to trusted networks as a temporary mitigation.
4. Review NetScaler and identity provider logs for unusual SAML assertions, crashes, or memory-related errors that could indicate exploitation attempts.
5. Segment management interfaces from the public internet and enforce multi-factor authentication for administrative access.
6. After patching, validate SAML flows and monitor for regressions in authentication.
7. Subscribe to Citrix security bulletins and re-check for updated guidance, as details may evolve.

CVE references

• CVE-2026-107406

Original source

The Hacker News