Citrix has issued an urgent call for users of its NetScaler ADC and NetScaler Gateway to address a critical security vulnerability. This flaw, identified as CVE-2026-107406, poses a risk of remote code execution or denial of service and has been given a CVSS v4.0 score of 9.5. The vulnerability specifically affects devices with certain SAML settings, and a detailed advisory was released on October 8, 2026, under the bulletin CTX697191.

While Citrix reports no known active exploits at the time of the bulletin's release, this does not imply that all systems are secure. Users are advised to verify their software version and authentication configurations to assess their risk of exposure. The vulnerability is classified as CWE-119, indicating improper memory buffer management, which could allow attackers to execute unauthorized code or disrupt services.

This issue is particularly relevant for systems configured as a SAML identity provider (IdP). For NetScaler ADC and Gateway builds ranging from 14.1-73.37 to 14.1-73.41, and 13.1-64.23 to 13.1-64.28, the risk applies only if the appliance is set as a SAML IdP. In contrast, older builds before 14.1-73.37 or 13.1-64.23 face broader exposure, affecting configurations as either a SAML IdP or service provider (SP).

Administrators should verify their systems using commands that identify SAML configurations and ensure compatibility with the specified version range. Citrix advises updating to version 14.1-73.46 or newer for the 14.1 branch, or 13.1-64.29 or newer for the 13.1 branch. Users of NetScaler ADC 14.1-FIPS should move to version 14.1-73.46 FIPS or later, while the fixed version for 13.1-FIPS and NDcPP is 13.1-37.283 or newer.

These updates are essential for maintaining secure systems and preventing potential exploits. The advisory does not address Citrix-managed cloud services or Adaptive Authentication, which are updated by Citrix directly. Given the history of previous NetScaler security concerns, it is crucial for administrators to follow the guidance in CTX697191 closely and apply the recommended patches without delay.