Tech Translated

IT Security & Technology Blog

Practical IT insights for Australian businesses. Our team covers cybersecurity advisories, compliance updates, and plain-English explainers on the technology your business relies on, published regularly as the landscape shifts.

Citrix NetScaler critical flaw CVE-2026-107406 — patch now, October 2026
By — Head of Relationships |

New Critical NetScaler Flaw Hits the Builds That Fixed Last Week's Zero-Day

If you patched your Citrix NetScaler last week to fix the zero-day that was under active attack, there's bad news: the very build you upgraded to carries another critical flaw. Anyone running SAML authentication needs to upgrade again.

On 9 October 2026, Citrix disclosed CVE-2026-107406, a critical memory-overflow vulnerability in NetScaler ADC and NetScaler Gateway rated CVSS 9.5. Under the right conditions it can lead to remote code execution or denial of service. It only affects appliances configured as a SAML Service Provider or Identity Provider — but that's a very common setup, because SAML is how most organisations wire NetScaler into single sign-on.

Here's the uncomfortable part. This flaw lives in the same SAML code as CVE-2026-88779, the zero-day Citrix rushed a fix for just days earlier after confirming targeted denial-of-service attacks against unpatched appliances. CISA added that one to its Known Exploited Vulnerabilities catalog. So the builds admins installed last week to stop the active exploitation still contain a fresh 9.5. If you use SAML, one patch cycle wasn't enough.

Patch now: Upgrade NetScaler ADC and Gateway to 14.1-73.46 or 13.1-64.29 (or the matching FIPS / NDcPP builds) and later. The builds that fixed last week's zero-day — 14.1-73.41 and 13.1-64.28 — are not enough if SAML is configured.

Am I Affected? Check for SAML

This only bites if your appliance acts as a SAML SP or IdP. Check your running config for either of these lines:

  • SAML Service Provider: look for add authentication samlAction
  • SAML Identity Provider: look for add authentication samlIdPProfile
  • Either present? You're in scope — upgrade to the fixed build above as soon as your change window allows.
The pattern we see in Australian environments: edge appliances like NetScaler, firewalls and VPN gateways are the boxes that get patched last — not because nobody cares, but because rebooting them locks every remote worker out, so the upgrade waits for an after-hours window that keeps slipping. Attackers know this. The internet-facing device you can't afford to take down is exactly the one they're scanning. When a vendor ships two critical fixes for the same component in a week, that gateway needs to jump the queue.

What to Do This Week

  • Confirm your current build. If you're on 14.1-73.41 or 13.1-64.28 from last week's rush, you are not yet covered for CVE-2026-107406.
  • Schedule the upgrade now, not "soon". Book an after-hours window this week for 14.1-73.46 / 13.1-64.29 (or your FIPS/NDcPP equivalent) rather than waiting for the next monthly cycle.
  • Review SAML and admin access. While you're in there, confirm management interfaces aren't internet-exposed and that admin accounts use strong, unique credentials.
  • Check your logs. Look for unexpected reboots or crafted login attempts — early signs of the related exploitation reported on NetScaler SAML.

If you're not sure who owns patching for your NetScaler — your internal team, a previous provider, or nobody in particular — that uncertainty is the real risk here. Edge devices fall through the cracks precisely because they "just work" until they don't.

All IT Services cybersecurity page: we keep internet-facing appliances patched on a managed cycle for businesses across Sydney, the Northern Beaches and Central West NSW — so a second critical fix in a week doesn't mean a scramble.
Sources CVE-2026-107406: Citrix Fixes Critical NetScaler ADC and Gateway Vulnerability, Security Affairs (9 October 2026)
Citrix patches NetScaler SAML zero-day exploited in attacks, BleepingComputer (4 October 2026)
NetScaler builds that fixed zero-days carry critical flaw, too, iTnews (12 October 2026)

Written by Dan Briggs, All IT Services. All IT is a Sydney-based managed IT provider supporting businesses across Australia, including the Northern Beaches, Central West NSW, Brisbane, and Melbourne.

Frequently Asked Questions

CVE-2026-107406 is a critical memory-overflow vulnerability in Citrix NetScaler ADC and NetScaler Gateway, rated CVSS 9.5. Under specific conditions it can lead to remote code execution or denial of service. It only affects appliances configured as a SAML Service Provider (SP) or SAML Identity Provider (IdP). Citrix disclosed it on 9 October 2026.
Check your running configuration for SAML. If you see 'add authentication samlAction' (SAML SP) or 'add authentication samlIdPProfile' (SAML IdP), the appliance is in scope. If SAML isn't configured, this particular flaw doesn't apply — but you should still be on a current build for the other NetScaler issues patched recently.
Possibly — but this flaw is in the same SAML code, and the builds that fixed last week's exploited zero-day (CVE-2026-88779) still contain CVE-2026-107406. If you upgraded to 14.1-73.41 or 13.1-64.28 last week and you use SAML, you need to upgrade again to 14.1-73.46 or 13.1-64.29 (or the matching FIPS/NDcPP builds).
Citrix says it is not aware of exploitation of CVE-2026-107406 in the wild. However, it sits in the same SAML code path as CVE-2026-88779, which CISA added to its Known Exploited Vulnerabilities catalog after confirmed attacks. Attackers are clearly focused on NetScaler SAML right now, so treat this as urgent rather than routine.

Who's Patching Your Edge Devices?

If you're not certain your firewalls, VPNs and NetScaler gateways are on a managed patch cycle, we can take that off your plate — and make sure urgent fixes like this one don't wait for the next maintenance window.

Talk to Us Managed IT & Support

Related Guide

Cybersecurity for Sydney SMBs

Explore our complete guide to protecting your business from cyber threats.

Read the Full Guide →
Posted in cybersecurity-advisory Security

About All IT Services

We’re a leading IT specialist providing premium services and support to businesses across Australia’s eastern seaboard. Our strength lies in our size – big enough to tackle complex projects yet small enough to pick up the phone when you call.  At All IT Services, our approach is refreshingly straightforward - no endless wait times or tech jargon. Just real people with genuine passion and expertise in IT solutions.

CONTACT US