CVE-2026-107406
CriticalCVSS 9.5Summary
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service in NetScaler ADC. NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to version-specific requirements: for versions 14.1-73.37 through 14.1-73.41 inclusive, 14.1-FIPS 14.1-73.37 FIPS through 14.1-73.41 FIPS inclusive, 13.1-64.23 through 13.1-64.28 inclusive, and 13.1-FIPS 13.1-NDcPP 13.1-37.279 through 13.1-37.282 inclusive — applicable only when configured as a SAML IdP; for versions before 14.1-73.37, 14.1-FIPS before 14.1-73.37 FIPS, before 13.1-64.23, and 13.1-FIPS before 13.1-NDcPP 13.1-37.279 — applicable when configured as a SAML SP or SAML IdP.
Risk Assessment
An attacker could exploit the memory overflow to remotely execute code or cause denial of service, potentially leading to device takeover or service unavailability.
Recommendation
Update NetScaler ADC and NetScaler Gateway to patched versions and verify the SAML SP/IdP configuration.
Other vulnerabilities in NetScaler ADC
See all- CVE-2026-8655Critical
Multiple memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway can lead to unpredictable or erroneous behavior and Denial of Service (DoS). The vulnerability occurs when NetScaler ADC is configured as an Oracle load balancer, DNS proxy, or DNS recursive resolver.
- CVE-2025-7775CriticalActively exploited
Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server, or in specific LB and CR virtual server configurations with IPv6 services.
- CVE-2025-6543CriticalActively exploited
Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.
- CVE-2026-8451High
Insufficient input validation in NetScaler ADC and NetScaler Gateway leads to memory overread when the device is configured as a SAML IDP.
- CVE-2026-13474High
The vulnerability allows a DoS attack via malformed HTTP/2 requests to NetScaler ADC and NetScaler Gateway. It occurs when HTTP/2 is enabled in the HTTP profile and associated with a virtual server (LB, CS, VPN) or a service configured on the device.
Original NVD description (English source)
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC. NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements: * For the following versions: Applicable only when configured as a SAML IdP: * NetScaler ADC and NetScaler Gateway between 14.1-73.37 and 14.1-73.41, inclusive * NetScaler ADC 14.1-FIPS between 14.1-73.37 FIPS and 14.1-73.41 FIPS, inclusive * NetScaler ADC and NetScaler Gateway between 13.1-64.23 and 13.1-64.28, inclusive * NetScaler ADC 13.1-FIPS between 13.1-NDcPP 13.1-37.279 and 13.1- 37.282, inclusive For the following versions: Applicable only when configured as a SAML SP or SAML IdP: * NetScaler ADC and NetScaler Gateway before 14.1-73.37 * NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS * NetScaler ADC and NetScaler Gateway before 13.1-64.23 * NetScaler ADC 13.1-FIPS before13.1-NDcPP 13.1-37.279
Vulnerability data from NVD (NIST) · CISA KEV · EPSS