10 October 2026
Reference: CVE-2026-107406
1. What is being reported?
The vulnerability is a memory overflow issue in Citrix NetScaler ADC and Gateway devices when they are set up to handle SAML authentication, a common method for managing user access. This flaw can let attackers run harmful code remotely or disrupt the service, affecting the security and availability of the system.
2. What this means in plain English
If your organisation uses Citrix NetScaler devices configured for SAML login, this vulnerability could let hackers break into your network or cause outages. This puts your business data and operations at risk, potentially leading to data loss or downtime.
3. Could this affect a small business?
Small businesses or charities using Citrix NetScaler or Gateway devices with SAML authentication might be affected. If you do not use these devices or SAML configurations, you are unlikely to be impacted. Check with your IT provider to confirm your setup.
4. What to do now
- Contact your IT provider immediately to check if you use Citrix NetScaler or Gateway devices with SAML authentication.
- If affected, apply the latest security patches from Citrix without delay.
- Review your access controls and monitor for any unusual activity on your network.
- Ensure regular backups are in place in case of disruption.
5. Ask your IT provider
Can you confirm whether our Citrix NetScaler or Gateway devices are configured with SAML authentication and if they have been patched against CVE-2026-107406?
6. Bottom line
If you use Citrix NetScaler with SAML, act quickly to patch and protect your systems from this critical vulnerability.
Information based on CISA KEV, NVD and reputable security news reports.