Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minutePatch decision in brief: NetScaler SAML exposure depends on the appliance’s exact release and build, whether it is configured as a SAML service provider (SP), identity provider (IdP), or both, and whether it is a standard, FIPS, or NDcPP edition. Cloud Software Group’s CVE-2026-107406 bulletin, initially published on October 8, 2026, describes a memory-overflow vulnerability that can enable remote code execution or denial of service and carries a CVSS v4.0 base score of 9.5.
For supported standard builds, the bulletin recommends 14.1-73.46 or later and 13.1-64.29 or later. FIPS and NDcPP appliances have separate criteria and fixed-build paths. Confirm the running build and SAML role against the current bulletin before scheduling maintenance; do not treat every NetScaler release as equally affected.
As an Amazon Associate I earn from qualifying purchases.
What CVE-2026-107406 means for NetScaler SAML deployments
CVE-2026-107406 is the latest SAML-related NetScaler bulletin covered here. Cloud Software Group classifies it as a memory-overflow issue with potential for remote code execution or denial of service. The severity is reflected in its CVSS v4.0 base score of 9.5, but the practical exposure still depends on configuration. An appliance that has no applicable SAML role may fall outside the affected condition for a particular release, while an appliance acting as an SP or IdP may be in scope.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The bulletin covers customer-managed NetScaler ADC and NetScaler Gateway deployments. Cloud Software Group states that it updates its managed cloud services and Adaptive Authentication separately. Secure Private Access Hybrid deployments can include NetScaler instances, so those instances still require an inventory and version check.
#1 Best Overall
Which builds are affected and which builds fix the issue?
The following summary applies to the standard-build conditions described in the bulletin. It is not a substitute for checking the complete release-specific notice, especially for FIPS and NDcPP editions.
| Release family and build | SAML condition identified by the bulletin | Action |
|---|---|---|
| Before 14.1-73.37 | Affected when configured as a SAML SP or SAML IdP | Upgrade to 14.1-73.46 or later |
| 14.1-73.37 through 14.1-73.41 | Affected when configured as a SAML IdP | Upgrade to 14.1-73.46 or later |
| Before 13.1-64.23 | Affected when configured as a SAML SP or SAML IdP | Upgrade to 13.1-64.29 or later |
| 13.1-64.23 through 13.1-64.28 | Affected when configured as a SAML IdP | Upgrade to 13.1-64.29 or later |
| 14.1-73.46 and later | Recommended fixed standard build | Remain on a supported fixed build and monitor later advisories |
| 13.1-64.29 and later | Recommended fixed standard build | Remain on a supported fixed build and monitor later advisories |
The notice lists parallel applicability rules for FIPS and NDcPP builds. Its recommended fixed versions include 14.1-73.46 FIPS and later, plus 13.1-37.283 and later for 13.1-FIPS/NDcPP. Do not infer that a standard-build number is interchangeable with a FIPS or NDcPP image. Record the edition as well as the release and build, then use the matching section of the bulletin.
How to check whether an appliance is a SAML SP or IdP
Start with the appliance’s running configuration, not with assumptions based on how users normally sign in. The bulletin identifies two configuration markers:
add authentication samlActionindicates a SAML service-provider action.add authentication samlIdPProfileindicates a SAML identity-provider profile.
Export or display the running configuration through your approved NetScaler administration method and search for those literal entries. An appliance can contain both markers and therefore perform both roles. Also record which virtual servers, authentication policies, and traffic flows reference the SAML objects; a dormant object can still matter during applicability review if it remains configured.
Inventory details to capture
- Exact release and build string, including the complete suffix shown by the appliance.
- Edition: standard, FIPS, or NDcPP.
- Role: SP, IdP, both, or neither.
- Whether the instance is customer-managed, part of Secure Private Access Hybrid, or supplied as a managed cloud service.
- High-availability peer, cluster, or secondary instances that must be checked separately.
- Maintenance constraints, backup location, and a tested recovery path.
Compare this inventory with the bulletin’s role- and version-specific conditions. If the build falls into a range not explicitly covered by the summary above, use the full current notice rather than guessing from the nearest version.
Safe patching workflow for customer-managed NetScaler
The bulletin’s fixed builds are the destination. The following workflow helps prevent a version-only change from breaking federation or leaving a second appliance unpatched.
- Map the deployment. List every ADC or Gateway instance, its edition, release/build, HA relationship, SAML role, and management owner. Include disaster-recovery and secondary appliances.
- Confirm applicability. Match each instance to the current CVE-2026-107406 affected ranges and the appropriate standard, FIPS, or NDcPP section. Treat an SP and an IdP differently where the bulletin does.
- Obtain the correct image. Select a supported fixed image for the same edition and release path. Do not install a standard image on a FIPS or NDcPP appliance, and do not assume that a later-looking build number belongs to the same branch.
- Back up before changing software. Save the running configuration and any required licenses, certificates, keys, and custom files according to your organization’s recovery procedure. Verify that the backup can be retrieved from the maintenance environment.
- Plan the service window. Account for reboot time, HA failover behavior, authentication-provider availability, and a rollback decision point. Notify application owners whose login flows depend on SAML.
- Upgrade using the vendor-supported method. Follow the installation procedure for the selected NetScaler edition and topology. In an HA pair, use the documented sequence for that topology rather than improvising a peer order.
- Verify the resulting build. After the appliance returns, read its version display and confirm the complete string is at or above the required fixed build for that edition. Repeat the check on every peer and standby instance.
- Exercise both SAML directions. Test a representative SP login, an IdP-initiated flow if used, logout behavior, assertion signing, and any Gateway virtual server that consumes SAML. Confirm that expected attributes and RelayState handling remain intact.
- Monitor and close the change. Review authentication and system logs for signature, audience, ACS, time, or certificate errors. Keep the pre-change configuration and rollback plan until the federation tests and an observation period are complete.
A software upgrade is not automatically a configuration remediation. Whether an additional job or command is required is determined by the specific security bulletin and release instructions, not by the fact that SAML is enabled.
Do older SAML CVE procedures apply to CVE-2026-107406?
Not automatically. A NetScaler remediation guide for the historical CVE-2021-22927 and CVE-2021-22920 required two distinct actions: upgrade the vulnerable instance to a fixed build, then run a customized configuration job containing all SAML actions for that instance. The guide allowed the configuration step to be skipped when the specified CVE-2020-8300 job had already been run.
That is a CVE-specific legacy workflow. It must not be presented as the general procedure for CVE-2026-107406. For the 2026 issue, follow the current bulletin and its release notes; add configuration changes only when those documents explicitly require them.
Rank #4
SAML certificate and signature checks
Validate the IdP certificate used by an SP
The SAML SP action must reference the same IdP certificate that the identity provider uses to sign assertions. A mismatch causes signature verification failures even when the rest of the federation settings are correct. The NetScaler SAML documentation describes RSA certificates as supported in this context and identifies HSM and FIPS certificates as unsupported for the described SAML use. Confirm certificate type, subject, validity period, and the configured object after an IdP certificate rotation.
Protect authentication requests and assertions
The Gateway documentation describes a signing certificate for authentication requests. It also provides an option to reject unsigned assertions when a signing certificate is not configured. Review the actual SP/IdP relationship before enabling or changing these controls: a setting that is appropriate for one flow can break another if the counterpart does not expect signed requests or assertions.
Free tools Windows power users keep installed
One-click scans. No signup required.
RelayState can contain routing information and should be encrypted or obfuscated as recommended in the Gateway guidance. Treat it as data that deserves protection, not as a harmless URL parameter.
Best Value
- Used Book in Good Condition
Clock skew: why a valid assertion can be rejected
SAML assertions carry time conditions. NetScaler’s SP documentation gives a default clock-skew allowance of five minutes. The allowance widens the period in which an assertion is accepted; it does not correct a broken system clock.
The documentation’s example sets skew to ten minutes when the configured time is 16:00. An assertion can then be accepted from 15:50 through 16:10, a 20-minute total window. Before increasing skew, synchronize the clocks on the NetScaler appliance, identity provider, and relevant clients. Use the smallest allowance that accommodates measured network and processing delay. An unnecessarily broad window gives an attacker more time to replay a captured assertion.
ACS URL validation and regular-expression pitfalls
The assertion consumer service (ACS) URL is a trust boundary. The IdP documentation warns that a loose regular expression can match unintended endpoints. A broad substring-style expression may accept a URL merely because it contains the expected text somewhere in the string.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Use a narrowly scoped pattern anchored to the exact HTTPS ACS endpoint required by the deployment. Check scheme, host, path, port, and any deliberate trailing-slash behavior. After changing the expression, test both the intended endpoint and a look-alike URL that should be rejected. This catches accidental matches before an attacker can exploit them.
Diagnosing common post-patch SAML failures
Signature or certificate errors
- Confirm the SP’s configured IdP certificate is the certificate currently signing assertions.
- Check expiration, validity dates, and whether the appliance trusts the intended certificate object.
- Verify that the certificate type is supported for the NetScaler SAML configuration.
“Not yet valid” or “expired” assertion errors
- Compare clocks on the appliance and identity provider using a trusted time source.
- Check the configured skew value and calculate the actual acceptance window.
- Inspect the assertion’s issue, not-before, and expiration times in a controlled test.
ACS or audience rejection
- Compare the assertion’s ACS and audience values with the exact endpoint configured on NetScaler.
- Replace broad matching with an anchored HTTPS rule that covers only the intended endpoint.
- Check for differences in hostnames, ports, path case, and trailing slashes.
Unsigned-request or RelayState problems
- Determine whether the flow requires a signing certificate for authentication requests.
- Ensure the IdP’s signing expectations match the Gateway or SP setting.
- Review RelayState protection and confirm that a post-upgrade policy change did not alter routing.
What administrators should document
Keep a short record for each appliance: build and edition, SAML role markers found, bulletin applicability, target fixed build, backup location, maintenance date, test transactions, and any configuration changes required by the release notes. Record why an appliance was considered out of scope when no SAML role was present. This makes future advisories faster to assess and prevents a rebuilt or standby instance from being overlooked.
Quick Recap
Operational checklist
- Exact build captured for every appliance and peer.
- Standard, FIPS, or NDcPP edition identified.
- SAML SP and IdP markers searched in the running configuration.
- Current bulletin checked for the matching role and release range.
- Fixed image selected for the matching edition.
- Configuration, certificates, keys, and licenses backed up.
- Clock synchronization and skew settings reviewed.
- ACS matching restricted to the intended HTTPS endpoint.
- Signing, unsigned-assertion, and RelayState settings tested.
- SP, IdP, and Gateway authentication flows verified after upgrade.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
