The NetScaler Fix That Misses Identity Providers, in a Bit

Citrix has now taken three fixes on the same SAML path in under two weeks, and the newest one does not cover every case.

• CVE-2026-107406 is a memory overflow in NetScaler ADC and NetScaler Gateway, rated 9.5 and filed as CWE-119.
• Only appliances configured as a SAML service provider or an identity provider are in scope.
• Builds from 14.1-73.37 to 73.41 and 13.1-64.23 to 64.28 are affected only as an identity provider.
• Older builds are affected in either role. The fix is 14.1-73.46 or 13.1-64.29 and later.
• The 27 September and 4 October flaws in the same family are exploited in the wild and on the federal known exploited list.

Check the appliance role before the version, then hunt for persistence if one of the earlier flaws got in. Read the full analysis.