Memory overflow vulnerability leading to Remote Code Execution or Denial of Service…

Citrix NetScaler ADC and Gateway

Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC. NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements: For the following versions: Applicable only when configured as a SAML IdP: NetScaler…

Do this now

Upgrade ADC to 14.1-73.46, 14.1-73.46 FIPS, 13.1-64.29 or 13.1.37.283 FIPS and Gateway to 14.1-73.46 or 13.1-64.29, matching your release line.

Fix it

ADC

On 13.1.37.xUpgrade to ADC 13.1.37.283 FIPS
On 13.1.64.xUpgrade to ADC 13.1-64.29
On 14.1.73.xUpgrade to ADC 14.1-73.46
On 14.1.73.xUpgrade to ADC 14.1-73.46 FIPS

Gateway

On 13.xUpgrade to Gateway 13.1-64.29
On 14.xUpgrade to Gateway 14.1-73.46

First seen: 1 Nov 2026
Last update: 1 Nov 2026, 10:18 UTC
Fixed in: ADC 14.1-73.46
ADC 13.1-64.29
ADC 14.1-73.46 FIPS
ADC 13.1.37.283 FIPS
Gateway 14.1-73.46
Gateway 13.1-64.29
Identifiers: CVE-2026-107406
CVSS: 9.5
Source: news
On the menu as: VPN & firewalls

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Memory overflow vulnerability leading to Remote Code Execution or Denial of Service…
Severity: critical. Patch status: patched.
Affected: Citrix NetScaler ADC and Gateway
Fixed in: ADC 14.1-73.46, ADC 13.1-64.29, ADC 14.1-73.46 FIPS, ADC 13.1.37.283 FIPS, Gateway 14.1-73.46, Gateway 13.1-64.29
Ids: CVE-2026-107406

Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC. NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements: For the following versions: Applicable only when configured as a SAML IdP: NetScaler…

## Steps
1. This touches infrastructure (vpn-edge). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.
2. Fix by release line: ADC: 14.1-73.46; 13.1-64.29; 14.1-73.46 FIPS; 13.1.37.283 FIPS. Gateway: 14.1-73.46; 13.1-64.29.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| ADC | fixed | 14.1-73.46 | — |
| ADC | fixed | 13.1-64.29 | — |
| ADC | fixed | 14.1-73.46 FIPS | — |
| ADC | fixed | 13.1.37.283 FIPS | — |
| Gateway | fixed | 14.1-73.46 | — |
| Gateway | fixed | 13.1-64.29 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-107406") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2026-107406 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697191
https://pwned.coffee/i/memory-overflow-vulnerability-leading-to-remote-code-exe-cve-2026-107406

Timeline

1 Nov 2026, 10:18 UTC
Fix status: unknown → patched.
1 Nov 2026
First reported.

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
ADC before 14.1-73.46 14.1-73.46 CVE record (CNA) checked 1 Nov
ADC before 13.1-64.29 13.1-64.29 CVE record (CNA) checked 1 Nov
ADC before 14.1-73.46 FIPS 14.1-73.46 FIPS CVE record (CNA) checked 1 Nov
ADC before 13.1.37.283 FIPS 13.1.37.283 FIPS CVE record (CNA) checked 1 Nov
Gateway before 14.1-73.46 14.1-73.46 CVE record (CNA) checked 1 Nov
Gateway before 13.1-64.29 13.1-64.29 CVE record (CNA) checked 1 Nov
Score: CVSS 9.5 (critical). CVSS 4.0 9.5 (CNA NetScaler) for CVE-2026-107406
Last checked: 1 Nov 2026, 12:17 UTC

Product	Affected	Fixed in	Source
ADC	before 14.1-73.46	14.1-73.46	CVE record (CNA) checked 1 Nov
ADC	before 13.1-64.29	13.1-64.29	CVE record (CNA) checked 1 Nov
ADC	before 14.1-73.46 FIPS	14.1-73.46 FIPS	CVE record (CNA) checked 1 Nov
ADC	before 13.1.37.283 FIPS	13.1.37.283 FIPS	CVE record (CNA) checked 1 Nov
Gateway	before 14.1-73.46	14.1-73.46	CVE record (CNA) checked 1 Nov
Gateway	before 13.1-64.29	13.1-64.29	CVE record (CNA) checked 1 Nov

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee