Citrix has urged NetScaler ADC and NetScaler Gateway customers to upgrade again after disclosing CVE-2026-107406, a critical memory overflow in SAML configurations that can lead to remote code execution or denial of service. Bulletin CTX697191, published on 8 October 2026, scores the flaw 9.5 under CVSS v4.0 and classes it as CWE-119, improper restriction of operations within a memory buffer.

The trap in the previous fix

The flaw affects appliances configured as a SAML service provider or identity provider, with version-specific conditions. On builds 14.1-73.37 to 14.1-73.41 and 13.1-64.23 to 13.1-64.28, the builds issued to fix the earlier CVE-2026-88779, only an appliance configured as a SAML identity provider is affected. Older builds are affected as either a service provider or an identity provider. That means administrators who applied the 3 October fix are still exposed on identity-provider configurations until they move again.

What to install now

Citrix strongly urges affected customers to install 14.1-73.46 or later, 13.1-64.29 or later, or the matching FIPS and NDcPP builds at 13.1.37.283 or later. The bulletin lists no workaround. Citrix said it was not aware of any unmitigated exploits at publication, and the flaw is not in CISA's Known Exploited Vulnerabilities catalogue. Administrators can check exposure in their configuration by looking for SAML service-provider or identity-provider entries, and should treat a SAML identity provider on any 73.37 to 73.41 or 64.23 to 64.28 build as still vulnerable.

Sources: Citrix bulletin CTX697191; secondary coverage by Cryptika and ThreatWire.