The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Citrix’s October 8, 2026 bulletin rates CVE-2026-107406 Critical and urges affected customers to install fixed NetScaler releases as soon as possible. The flaw is a memory overflow that can lead to remote code execution (RCE) or denial of service (DoS). Whether a particular NetScaler appliance is exposed depends on two things: its exact release track and build, and whether it is configured as a SAML service provider (SP) or a SAML identity provider (IdP). Not every NetScaler deployment shares the same condition, so the first job for an administrator is to establish which case applies.
What the bulletin says about severity
The bulletin, Citrix Support article CTX697191, describes the issue in these words: “Memory overflow vulnerability leading to Remote Code Execution or Denial of Service.” Citrix labels it Critical and publishes a CVSS v4.0 base score of 9.5 (CVSS v4.0 base score) — Cloud Software Group, 2026. That figure is the vendor’s severity rating of the vulnerability. It is not a count of incidents and not a estimate of the likelihood of attack.
As an Amazon Associate I earn from qualifying purchases.
The bulletin does not state that the flaw has been exploited in the wild, and it does not report any compromised customers. Treat the advisory as a patch-now instruction for vulnerable configurations, not as evidence of an active attack campaign.
Which deployments are in scope
The bulletin covers customer-managed NetScaler ADC and NetScaler Gateway. It also names Secure Private Access Hybrid deployments that use NetScaler instances, which it says are affected and should be upgraded to the recommended versions. Citrix-managed cloud services and Citrix-managed Adaptive Authentication are handled by Cloud Software Group, which states that it applies the necessary updates to those services itself.
#1 Best Overall
For customer-managed systems, the applicable condition depends on three factors: the product edition (standard or FIPS/NDcPP), the release track (14.1 or 13.1), and the exact build. The table below summarises the version conditions as Citrix presents them. For any build not clearly covered by a row, the affected-version table in CTX697191 is the controlling reference.
Affected versions and fixed releases
Read each row as two separate questions. The first is whether the build falls in the “IdP-only” range, which makes the appliance affected only if it is configured as a SAML IdP. The second is whether the build falls before the “SP-or-IdP” boundary, which makes it affected in either SAML role. Builds at or above the fixed release in the final column are not affected by this bulletin.
| Edition and track | Affected only if SAML IdP (builds in range) | Affected if SAML SP or IdP (builds before) | Fixed release floor |
|---|---|---|---|
| Standard ADC/Gateway 14.1 | 14.1-73.37 through 14.1-73.41 inclusive | Before 14.1-73.37 | 14.1-73.46 and later |
| Standard ADC/Gateway 13.1 | 13.1-64.23 through 13.1-64.28 inclusive | Before 13.1-64.23 | 13.1-64.29 and later 13.1 releases |
| ADC 14.1-FIPS | 14.1-73.37 FIPS through 14.1-73.41 FIPS inclusive | Before 14.1-73.37 FIPS | 14.1-73.46 FIPS and later 14.1-FIPS releases |
| ADC 13.1-FIPS and 13.1-NDcPP | 13.1-NDcPP 13.1-37.279 through 13.1-37.282 inclusive | Before 13.1-NDcPP 13.1-37.279 | 13.1-37.283 and later releases in those tracks |
Do not reduce these conditions to a single version cutoff. A standard 14.1 appliance and a 14.1-FIPS appliance can sit at different build numbers and face different thresholds, and the FIPS/NDcPP 13.1 track uses its own numbering. Confirm the exact build string on each appliance before you act on any row.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRank #2
- RAID 0, 1, 5, 10, 50 and JBOD mode
- 6Gb/s data transfer rate, Eight internal 6GB/s SATA+SAS ports, Two x4 Mini-SAS Internal connectors (SFF8087), Patrol read, Consistency Check, S.M.A.R.T error detection, Power management support, MegaRAID Storage Manager
- Cables have to be bought separately
How to check whether your appliance is exposed
Citrix identifies two configuration entries that indicate SAML use. Presence of either one is only part of the determination; it must be combined with the version conditions above.
- Confirm the exact build of each NetScaler ADC or Gateway appliance and its edition (standard or FIPS/NDcPP).
- Search the running configuration of each appliance for
add authentication samlAction. Its presence indicates a SAML SP configuration. - Search the same configuration for
add authentication samlIdPProfile. Its presence indicates a SAML IdP configuration. - Find the matching row in the table above. If the appliance has a SAML SP entry and its build is below the SP-or-IdP boundary, it is affected. If it has only a SAML IdP entry, it is affected when its build falls within the IdP-only range or below the SP-or-IdP boundary.
- If the build is at or above the fixed release floor for its track, no further action under this bulletin is required for that appliance. Record the result per appliance.
An appliance with neither configuration entry is not described as affected by the bulletin’s conditions. Check the full CTX697191 table if you have builds that do not match any row, or if you are unsure how a configuration is classified.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What Citrix recommends
Citrix’s wording is direct: “Cloud Software Group strongly urges affected customers of NetScaler ADC and NetScaler Gateway to install the following updated versions as soon as possible.” Install the fixed release for your track, or a later release in the same track, as listed in the table. The bulletin does not describe a non-upgrade workaround, so the practical path is to upgrade affected appliances rather than rely on configuration changes.
Customers who need help with the upgrade should contact Citrix Technical Support. The bulletin also recommends subscribing to Citrix security bulletin alerts, which notify you when bulletins are created or modified. Because the affected-version ranges are specific, check CTX697191 again after any update, since Citrix may revise the table.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Attribution and timeline
Citrix’s acknowledgement reads: “Cloud Software Group acknowledges Michael Tucker, Chew Keong Tan and Alex Bernier of the JPMorgan Chase XOR Team, and Maxim Suhanov, for working with us to protect our customers.” The bulletin’s changelog records 2026-10-08 — Citrix Support, 2026 as its initial publication date, and notes that a link to a related NetScaler blog was added the same day.
The bulletin does not publish affected-customer counts or any other measure of how widely the flaw is present across the installed base.
Scope limits to keep in mind
- The bulletin concerns customer-managed NetScaler systems and Secure Private Access Hybrid NetScaler instances. Citrix-managed cloud services are updated by Cloud Software Group.
- Exposure is conditional. Standard and FIPS/NDcPP tracks, and SAML SP versus IdP roles, lead to different results.
- The bulletin states no exploitation and no compromised customers. Those points are outside what the advisory establishes.
Use the four axes that determine applicability when you review your estate: edition and track, exact build, SAML role, and whether the appliance is customer-managed or Citrix-managed. Each one changes which release floor you need.
Quick Recap
“
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
