Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Citrix says CVE-2026-107406 is a critical memory-overflow vulnerability in NetScaler ADC and NetScaler Gateway that could allow remote code execution (RCE) or denial of service. Whether an appliance is affected depends on its build, its SAML service-provider (SP) or identity-provider (IdP) role, and whether it runs a standard or FIPS/NDcPP release. Administrators of affected customer-managed systems should upgrade to the fixed build for their release track.
What the NetScaler vulnerability does
Citrix’s security bulletin, published October 8, 2026, identifies the flaw as CVE-2026-107406. Citrix describes it as a memory overflow that may lead to remote code execution or denial of service. The bulletin assigns it a Critical severity and a CVSS v4.0 base score of 9.5; the listed weakness category is CWE-119.
The bulletin’s severity and impact describe the vulnerability, not confirmed exploitation. It does not establish whether attackers are exploiting the flaw in the wild.
How to tell whether your deployment is affected
Use the exact appliance build and release track, then determine whether the appliance has a SAML SP action, an IdP profile, or both. Citrix’s applicability differs by version range: some ranges are affected only when configured as a SAML IdP, while earlier builds are affected when configured as either an SP or IdP.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Standard NetScaler ADC and Gateway
| Release track and installed build | Affected SAML configuration | Fixed build |
|---|---|---|
| ADC and Gateway 14.1-73.37 through 14.1-73.41, inclusive | SAML IdP only | 14.1-73.46 and later 14.1 releases |
| ADC and Gateway before 14.1-73.37 | SAML SP or IdP | 14.1-73.46 and later 14.1 releases |
| ADC and Gateway 13.1-64.23 through 13.1-64.28, inclusive | SAML IdP only | 13.1-64.29 and later 13.1 releases |
| ADC and Gateway before 13.1-64.23 | SAML SP or IdP | 13.1-64.29 and later 13.1 releases |
FIPS and NDcPP NetScaler ADC
| Release track and installed build | Affected SAML configuration | Fixed build |
|---|---|---|
| ADC 14.1-FIPS 14.1-73.37 FIPS through 14.1-73.41 FIPS, inclusive | SAML IdP only | 14.1-73.46 FIPS and later releases |
| ADC 14.1-FIPS before 14.1-73.37 FIPS | SAML SP or IdP | 14.1-73.46 FIPS and later releases |
| ADC 13.1-FIPS/NDcPP 13.1-37.279 through 13.1-37.282, inclusive | SAML IdP only | 13.1.37.283 and later 13.1-FIPS or 13.1-NDcPP releases |
| ADC 13.1-FIPS/NDcPP before 13.1-37.279 | SAML SP or IdP | 13.1.37.283 and later 13.1-FIPS or 13.1-NDcPP releases |
These are separate release tracks: do not apply a standard-release threshold to a FIPS/NDcPP appliance. The affected-range and fixed-build information is from Citrix’s CVE-2026-107406 bulletin.
Check whether SAML SP or IdP objects are configured
Citrix identifies the following configuration entries as indicators of SAML roles:
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
add authentication samlActionindicates a SAML SP action.add authentication samlIdPProfileindicates a SAML IdP profile.
Finding an entry alone does not determine exposure. Compare the appliance’s exact build and product track with the tables above, and match the configured role to the affected condition for that version range. If an appliance has both roles, treat it as having both when checking applicability.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhat to do if the appliance is affected
- Confirm the installed NetScaler build and whether the appliance is standard, FIPS, or NDcPP.
- Check the configuration for the SAML SP and IdP entries listed above and identify the configured roles.
- Match the build and role to Citrix’s applicable affected range, then select the corresponding fixed threshold for that release track.
- Upgrade affected customer-managed appliances to the listed fixed build or a later release on the same track, following your normal change-control and validation procedures.
Citrix urges affected customers to install the updated versions as soon as possible. Secure Private Access Hybrid deployments that use NetScaler instances are also called out as affected; those instances should be upgraded.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
Who needs to apply an update
The bulletin covers customer-managed NetScaler ADC and NetScaler Gateway. Cloud Software Group says it updates Citrix-managed cloud services and Citrix-managed Adaptive Authentication, so customers do not apply appliance updates to those managed services themselves. This distinction does not remove the need to update customer-managed NetScaler instances used alongside a managed service.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Does SAML hardening replace the patch?
No. Citrix’s separate SAML configuration reference gives general configuration guidance, but it is not a substitute for installing the CVE-specific fix.
Rank #4
- Runs UniFi Network for full-stack network management
- Manages 30+ UniFi Network devices and 300+ clients
- 1 Gbps routing with IDS/IPS
- Multi-WAN load balancing
- 0.96" LCM status display
- For a SAML SP, Citrix recommends setting
relayStateRuleto restrict relay state to the published domains associated with the authentication flow. - For a SAML IdP, Citrix recommends setting
acsURLRuleto match the relevant service-provider URL. - On partitioned appliances, the reference notes that the configuration should be updated across partitions.
Technical details and acknowledgement
Citrix lists the CVSS v4.0 vector as CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L. The vector records network attack vector, high attack complexity, no privileges or user interaction required, and impacts to confidentiality, integrity, and availability. Citrix acknowledges Michael Tucker, Chew Keong Tan, and Alex Bernier of the JPMorgan Chase XOR Team, and Maxim Suhanov, for working with the company to protect customers.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
