Read the docs
TI-2026-69770 Aliases CVE-2026-107406GHSA-x62m-6223-4vq2

Memory overflow in NetScaler ADC and Gateway allows code execution

Priority MEDIUM 47CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

NetScaler ADC and NetScaler Gateway before 14.1-73.46 and before 13.1-64.29 are affected, as are NetScaler ADC FIPS before 14.1-73.46 FIPS and before 13.1.37.283 FIPS, when configured as a SAML SP or SAML IdP. A memory overflow flaw (CWE-119) lets a remote attacker write past the bounds of a memory buffer. An unauthenticated remote attacker can exploit it without user interaction, though with high attack complexity, to execute code or cause a denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC. NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements:   * For the following versions: Applicable only when configured as a SAML IdP: * NetScaler ADC and NetScaler Gateway between 14.1-73.37 and 14.1-73.41, inclusive * NetScaler ADC 14.1-FIPS between 14.1-73.37 FIPS and 14.1-73.41 FIPS, inclusive * NetScaler ADC and NetScaler Gateway between 13.1-64.23 and 13.1-64.28, inclusive * NetScaler ADC 13.1-FIPS between 13.1-NDcPP 13.1-37.279 and 13.1- 37.282, inclusive   For the following versions: Applicable only when configured as a SAML SP or SAML IdP: * NetScaler ADC and NetScaler Gateway before 14.1-73.37  * NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS  * NetScaler ADC and NetScaler Gateway before 13.1-64.23 * NetScaler ADC 13.1-FIPS before13.1-NDcPP 13.1-37.279

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01874 79th percentileScored 2026-11-07
Fix Fixed ADC (NetScaler): 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS +1Gateway (NetScaler): 14.1-73.46, 13.1-64.29

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CitrixADCbefore 14.1-73.46; before 13.1-64.29; before 14.1-73.46 FIPS; before 13.1.37.283 FIPS14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS, 13.1.37.283 FIPSPatch availableCNA
CitrixGatewaybefore 14.1-73.46; before 13.1-64.2914.1-73.46, 13.1-64.29Patch availableCNA
  • ADC VendorCitrix Affected before 14.1-73.46; before 13.1-64.29; before 14.1-73.46 FIPS; before 13.1.37.283 FIPS Fixed in 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS, 13.1.37.283 FIPS Patch available CNA
  • Gateway VendorCitrix Affected before 14.1-73.46; before 13.1-64.29 Fixed in 14.1-73.46, 13.1-64.29 Patch available CNA

Remediation

Upgrade NetScaler ADC to 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS or 13.1.37.283 FIPS, and upgrade NetScaler Gateway to 14.1-73.46 or 13.1-64.29. The sources list no advisory identifier for these fixes.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA ADC (NetScaler) Fixed in 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS, 13.1.37.283 FIPS
  • Fix · CNA Gateway (NetScaler) Fixed in 14.1-73.46, 13.1-64.29

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-107406
  2. 2026-10-09 Weakness changed · CISA ADP
  3. 2026-10-09 CISA SSVC decision points changed
  4. 2026-10-09 Alias added: GHSA-x62m-6223-4vq2
  5. 2026-10-10 CISA SSVC decision points changed
  6. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Other 1

  • TI-2026-60195 Memory overflow vulnerability leading to Remote Code Execution or Denial of Service KEVCVSS 4.0CRITICAL 9.5
  • TI-2026-60194 Improper input validation in Citrix ADC KEVCVSS 4.0CRITICAL 9.5
  • TI-2023-10110 Improper access control in Citrix ShareFile Storage Zones Controller KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-04571 Unauthenticated sensitive information disclosure in Citrix NetScaler ADC KEVCVSS 3.1CRITICAL 9.4
  • TI-2023-03284 Unauthenticated remote code execution in Citrix NetScaler ADC KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-10528 Unauthenticated remote arbitrary code execution in Citrix Gateway, Citrix ADC KEVCVSS 3.1CRITICAL 9.8
See all 418 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences