NETSCALER ADC · CVE-2026-107413 · Infrastructure
FIX → 14.1-73.57 · 13.1-64.39 +2 ✓ verified
A memory overflow in SAML authentication in Citrix NetScaler ADC and NetScaler Gateway can cause unpredictable or erroneous behavior. The flaw can be used to cause a denial of service against the appliance.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
NetScaler ADC and NetScaler Gateway appliances configured with a SAML action are exposed. Citrix rates it CVSS v4 8.7, network-reachable with no privileges or user interaction, and the impact is denial of service (availability only). Appliances with no SAML action configured can skip it, but the same bulletin lists many other CVEs fixed by the same builds.
Not affected if no-saml-action, no-saml-auth
Who cares citrix-netscaler, netscaler-adc, netscaler-gateway, saml, self-hosted
add authentication samlAction in the running config (show running | grep samlAction)Memory overflow in SAML authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 14.1-73.57 · 13.1-64.39 +2
Update to NetScaler ADC/Gateway 14.1-73.57 or later, 13.1-64.39 or later 13.1, 14.1-FIPS 14.1-73.58 FIPS or later, or 13.1-FIPS/13.1-NDcPP 13.1-37.293 or later.