Loading vulnerability…
CVE-2026-107406 is a memory overflow vulnerability in the SAML processing of Citrix NetScaler ADC and NetScaler Gateway. An unauthenticated remote attacker could exploit an affected appliance to execute arbitrary code or cause denial of service. Exposure depends on the installed software build and whether the appliance operates as a SAML service provider (SP) or identity provider (IdP). Specified newer affected builds are vulnerable only in IdP configurations, while earlier builds are vulnerable in either role. Customer-managed appliances and Secure Private Access Hybrid deployments using affected NetScaler instances are in scope. The precise vulnerable function and buffer have not been publicly identified.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No valid public exploits. Mallory filtered out 3 candidates as fakes, detection scripts, or README-only repos.
All candidate exploits were filtered out by Mallory's validation.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
92 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical memory overflow vulnerability in customer-managed NetScaler ADC and Gateway appliances, classified as CWE-119 and rated CVSS v4.0 9.5. Remote exploitation requires neither authentication nor user interaction, but attack complexity is high. Exposure depends on the software build and SAML SP or IdP configuration. Successful exploitation could permit arbitrary code execution or denial of service on perimeter infrastructure. Citrix disclosed the issue on October 8, 2026, in bulletin CTX697191. Fixed releases include 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS, and 13.1-37.283 for 13.1-FIPS/NDcPP, or later versions in the corresponding branches. The reference reports no identified public proof of concept or confirmed real-world exploitation campaign at publication; this does not establish that private exploits do not exist.
A vulnerability affecting NetScaler ADC and NetScaler Gateway versions prior to 13.1-64.29 and 14.1-73.46, and NetScaler ADC FIPS versions prior to 14.1-73.46 FIPS and 13.1-37.283 FIPS & NDcPP. The notice does not describe the vulnerability's technical nature, impact, or severity.
A critical memory-buffer vulnerability in NetScaler ADC and NetScaler Gateway that can enable remote code execution or denial of service. Older affected builds are vulnerable in SAML service-provider or identity-provider configurations; some newer builds are affected only in identity-provider configurations. Secure Private Access Hybrid deployments using affected NetScaler instances also require updates. Citrix has not stated whether exploitation has occurred.
A critical memory overflow vulnerability with a CVSS v4.0 score of 9.5 affecting Citrix NetScaler ADC and NetScaler Gateway. Depending on software version and SAML Service Provider or Identity Provider configuration, exploitation could permit remote code execution or denial of service. Fixed releases include 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS, and 13.1.37.283 for the applicable FIPS and NDcPP branches.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.