Buffer overflow in Citrix Netscaler ADC and Citrix NetScaler Gateway - CVE-2026-107406

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU154043

Buffer overflow in Citrix Netscaler ADC and Citrix NetScaler Gateway - CVE-2026-107406

Published: October 9, 2026


Vulnerability identifier: #VU154043
CSH Severity: Critical
CVSS v4: 9.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]
CVE-ID: CVE-2026-107406
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in Citrix NetScaler ADC and Citrix NetScaler Gateway when the appliance is configured as a SAML service provider or identity provider, subject to version-specific configuration requirements. A remote attacker can send specially crafted authentication requests to the affected system, trigger buffer overflow and execute arbitrary code with elevated privileges.


Affected software

Citrix Netscaler ADC
Citrix NetScaler Gateway

How to mitigate CVE-2026-107406

Install security update from vendor's website.

Citrix Netscaler ADC - addressed in versions 13.1.37.283, 13.1-64.29, 14.1-73.46
Citrix NetScaler Gateway - addressed in versions 13.1-64.29, 14.1-73.46

External References

Related Security Bulletins