CVE-2026-107406: Vulnerability in NetScaler ADC

This vulnerability in NetScaler ADC and NetScaler Gateway involves a memory overflow condition that can be triggered when the product is configured as a SAML SP or IdP. The affected versions include NetScaler ADC and Gateway versions prior to 14.1-73.46 and 13.1-64.29, with specific version ranges detailed for both standard and FIPS builds. Successful exploitation could allow an unauthenticated attacker to execute arbitrary code remotely or cause a denial of service. The CVSS 4.0 vector indicates network attack vector, high complexity, no privileges or user interaction required, and high impacts on confidentiality, integrity, availability, and security scope.

An attacker exploiting this memory overflow vulnerability could achieve remote code execution or cause a denial of service on affected NetScaler ADC or Gateway devices configured as SAML SP or IdP. This could lead to full compromise of the device, impacting confidentiality, integrity, and availability of services relying on these devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should review their NetScaler ADC and Gateway configurations, especially SAML SP and IdP settings, and apply any temporary mitigations recommended by the vendor. Monitor vendor channels for patch releases addressing this vulnerability.