CVE-2026-107406: critical vulnerability in NetScaler ADC
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service
Published · Updated
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.5epss 0.5%
from disclosure to weapon1 days
Published on NVDOct 8
1st PoC+1d
exploitation probability
0.5%top 61% of all CVEs
observed exploitation
nono source reports it
3 public exploit(s)
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC.
NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements:
* For the following versions: Applicable only when configured as a SAML IdP:
* NetScaler ADC and NetScaler Gateway between 14.1-73.37 and 14.1-73.41, inclusive
* NetScaler ADC 14.1-FIPS between 14.1-73.37 FIPS and 14.1-73.41 FIPS, inclusive
* NetScaler ADC and NetScaler Gateway between 13.1-64.23 and 13.1-64.28, inclusive
* NetScaler ADC 13.1-FIPS between 13.1-NDcPP 13.1-37.279 and 13.1- 37.282, inclusive
For the following versions: Applicable only when configured as a SAML SP or SAML IdP:
* NetScaler ADC and NetScaler Gateway before 14.1-73.37
* NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS
* NetScaler ADC and NetScaler Gateway before 13.1-64.23
* NetScaler ADC 13.1-FIPS before13.1-NDcPP 13.1-37.279
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L
public PoCs found — 3
githubgithub.com/techupdate24/citrix-netscaler-rce-cve-2026-107406★ 0githubgithub.com/ApexBreach/CVE-2026-107406-Poc★ 0githubgithub.com/ctroy999/CVE-2026-107406★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — NetScaler ADC
In the same product, most dangerous first.
CVE-2025-5777CRITICALNetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overreadEPSS 100.0%KEVCVE-2026-19490CRITICALNetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490EPSS 23.2%KEVCVE-2025-7775CRITICALMemory overflow vulnerability leading to Remote Code Execution and/or Denial of ServiceEPSS 20.3%KEVCVE-2025-6543CRITICALMemory overflow vulnerability leading to unintended control flow and Denial of ServiceEPSS 10.6%KEVCVE-2026-3055CRITICALInsufficient input validation leading to memory overreadEPSS 4.0%KEVCVE-2026-8452HIGHMemory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of ServiceEPSS 1.0%KEV