CVE-2026-107406

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-08

Last updated on: 2026-10-10

Assigner: NetScaler

Description

Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC. NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements: * For the following versions: Applicable only when configured as a SAML IdP: * NetScaler ADC and NetScaler Gateway between 14.1-73.37 and 14.1-73.41, inclusive * NetScaler ADC 14.1-FIPS between 14.1-73.37 FIPS and 14.1-73.41 FIPS, inclusive * NetScaler ADC and NetScaler Gateway between 13.1-64.23 and 13.1-64.28, inclusive * NetScaler ADC 13.1-FIPS between 13.1-NDcPP 13.1-37.279 and 13.1- 37.282, inclusive For the following versions: Applicable only when configured as a SAML SP or SAML IdP: * NetScaler ADC and NetScaler Gateway before 14.1-73.37 * NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS * NetScaler ADC and NetScaler Gateway before 13.1-64.23 * NetScaler ADC 13.1-FIPS before13.1-NDcPP 13.1-37.279

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-10

Generated

2026-10-19

AI Q&A

2026-10-09

EPSS Evaluated

2026-10-18

NVD

CVE-2026-107406

EUVD

EUVD-2026-95315

Affected Vendors & Products

Vendor	Product	Version / Range
NetScaler	ADC	0
NetScaler	ADC	0
NetScaler	ADC	0
NetScaler	ADC	0
NetScaler	Gateway	0
NetScaler	Gateway	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

This is a memory overflow vulnerability in NetScaler ADC and NetScaler Gateway that can lead to Remote Code Execution or Denial of Service. It specifically affects systems configured as SAML Service Providers (SP) or Identity Providers (IdP) within certain version ranges.

Detection Guidance

This vulnerability affects NetScaler ADC or NetScaler Gateway configured as SAML SP or IdP. Check version numbers against affected ranges (13.1.x, 14.1.x) using commands like 'show version' on NetScaler CLI or inspect system logs for SAML-related errors.

Impact Analysis

An attacker could exploit this flaw to execute arbitrary code on your system or cause a denial of service, potentially leading to unauthorized access, data breaches, or service disruption. Systems running vulnerable versions of NetScaler ADC or Gateway are at risk if configured for SAML operations.

Compliance Impact

The vulnerability's impact on compliance with standards like GDPR or HIPAA is not explicitly detailed in the provided CVE context. However, memory overflow vulnerabilities leading to Remote Code Execution or Denial of Service can potentially compromise data confidentiality, integrity, and availability, which are critical for GDPR and HIPAA compliance.

Mitigation Strategies

Update NetScaler ADC or NetScaler Gateway to versions 14.1-73.37 or later, 14.1-73.37 FIPS or later, 13.1-64.23 or later, or 13.1-NDcPP 13.1-37.279 or later. If configured as SAML IdP, ensure versions are 14.1-73.37 or later, 14.1-73.37 FIPS or later, 13.1-64.23 or later, or 13.1-NDcPP 13.1-37.279 or later.

Hi! I’m here to help you understand CVE-2026-107406. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70