NetScaler patches a CVSS 9.5 memory overflow reachable only through SAML

Cloud Software Group's bulletin CTX697191, published October 8, covers CVE-2026-107406, a memory overflow (CWE-119, CVSS v4.0 9.5) in NetScaler ADC and NetScaler Gateway that can lead to remote code execution or denial of service. It only applies when the appliance is configured for SAML. Builds before 14.1-73.37 and 13.1-64.23 are exposed as either a SAML service provider or identity provider; builds 14.1-73.37 to 14.1-73.41 and 13.1-64.23 to 13.1-64.28 only as an identity provider. Fixed releases are 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS and 13.1-37.283 FIPS/NDcPP. Secure Private Access hybrid deployments are also affected. The bulletin does not report exploitation, and the flaw is not in CISA's KEV catalog. Researchers from the JPMorgan Chase XOR team and Maxim Suhanov reported it.

Why it matters

When NetScaler is the SAML identity provider, its signing key is what every federated application trusts to say who a user is. Code execution on that box is a path to the key, and a stolen key forges logins for any user long after the patch. Our CVE-2026-107406 brief has affected builds and hunting steps.

This lands days after the exploited SAML zero-day CVE-2026-88779 went onto KEV (two other NetScaler flaws were added in late September), and after the August Gateway and AAA authentication bypass. Check configs for samlIdPProfile and samlAction, upgrade, and if an IdP-mode appliance was exposed on an old build, rotate its SAML signing certificate and update relying party metadata.

Source: The Hacker News