CVE-2026-107406: Memory overflow vulnerability leading to Remote Code Execution or Denial of Service

Severity: critical (CVSS 9.5 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-08 · updated 2026-10-10
Weakness: CWE-119

Description

Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC. NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements: * For the following versions: Applicable only when configured as a SAML IdP: * NetScaler ADC and NetScaler Gateway between 14.1-73.37 and 14.1-73.41, inclusive * NetScaler ADC 14.1-FIPS between 14.1-73.37 FIPS and 14.1-73.41 FIPS, inclusive * NetScaler ADC and NetScaler Gateway between 13.1-64.23 and 13.1-64.28, inclusive * NetScaler ADC 13.1-FIPS between 13.1-NDcPP 13.1-37.279 and 13.1- 37.282, inclusive For the following versions: Applicable only when configured as a SAML SP or SAML IdP: * NetScaler ADC and NetScaler Gateway before 14.1-73.37 * NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS * NetScaler ADC and NetScaler Gateway before 13.1-64.23 * NetScaler ADC 13.1-FIPS before13.1-NDcPP 13.1-37.279

Affected products

NetScaler ADC: before 14.1-73.46; before 13.1-64.29; before 14.1-73.46 FIPS; before 13.1.37.283 FIPS — fixed in 13.1-64.29, 13.1.37.283 FIPS, 14.1-73.46, 14.1-73.46 FIPS
NetScaler Gateway: before 14.1-73.46; before 13.1-64.29 — fixed in 13.1-64.29, 14.1-73.46

How to fix

Upgrade to a fixed version: NetScaler ADC 13.1-64.29, 13.1.37.283 FIPS, 14.1-73.46, 14.1-73.46 FIPS; NetScaler Gateway 13.1-64.29, 14.1-73.46. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-107406 or the next vulnerability affects your stack