{"id":"CVE-2026-107413","kind":"vulnerability","aliases":["CVE-2026-107413"],"related":[],"title":"Citrix NetScaler: SAML authentication memory overflow enables denial of service","description":"Memory overflow in SAML authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.","summary":"A memory overflow in SAML authentication in Citrix NetScaler ADC and NetScaler Gateway can cause unpredictable or erroneous behavior. The flaw can be used to cause a denial of service against the appliance.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NetScaler ADC","fixed":["14.1-73.57","13.1-64.39","14.1-FIPS 14.1-73.58","13.1-FIPS 13.1-37.293"],"affected":"unknown","ecosystem":"vendor"},{"name":"NetScaler Gateway","fixed":["14.1-73.57","13.1-64.39"],"affected":"unknown","ecosystem":"vendor"}],"ecosystems":[],"tags":["citrix-netscaler","infrastructure","netscaler-adc","netscaler-gateway","saml","self-hosted"],"not_affected_if":["no-saml-action","no-saml-auth"],"how_to_check":"Exposed only if the appliance is configured with a SAML action (Citrix precondition). On the appliance, look for 'add authentication samlAction' in the running config (show running | grep samlAction). Then compare the firmware (show version) with the fixed builds: 14.1-73.57, 13.1-64.39, 14.1-FIPS 14.1-73.58, 13.1-FIPS/NDcPP 13.1-37.293. The bulletin as read does not give the first affected build; treat anything older than the fixed build as unpatched until Citrix says otherwise.","fix":"Update to NetScaler ADC/Gateway 14.1-73.57 or later, 13.1-64.39 or later 13.1, 14.1-FIPS 14.1-73.58 FIPS or later, or 13.1-FIPS/13.1-NDcPP 13.1-37.293 or later.","status":"open","published_at":"2026-11-13T03:17:28+00:00","first_seen_at":"2026-11-13T03:42:55+00:00","triaged_at":"2026-11-13T03:43:17+00:00","updated_at":"2026-11-13T03:44:49+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-13T03:43:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Citrix NetScaler: SAML authentication memory overflow enables denial of service","impact":"medium","summary":"A memory overflow in SAML authentication in Citrix NetScaler ADC and NetScaler Gateway can cause unpredictable or erroneous behavior. The flaw can be used to cause a denial of service against the appliance.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["citrix-netscaler","netscaler-gateway","saml"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Appliance crashes or misbehaves, causing denial of service","analyst_note":"Sources give only the NVD record; check the Citrix security bulletin for affected and fixed versions and whether pre-authentication access is needed.","how_to_check":"- Confirm whether SAML authentication is configured on NetScaler ADC or NetScaler Gateway.\n- Check the installed firmware version on the appliance against the vendor's advisory: unknown.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-saml-auth"],"who_is_affected":"Organizations running Citrix NetScaler ADC or NetScaler Gateway that use SAML authentication are exposed. Deployments that do not use SAML authentication are not described as affected by the sources. The sources do not list affected firmware ranges.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00072,"input_tokens":4519,"output_tokens":536,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources give only the NVD record; check the Citrix security bulletin for affected and fixed versions and whether pre-authentication access is needed.","search":"'-107413':13A,16A '-2026':12A,15A 'adc':18A,27B,44B,87C 'applianc':67B 'authent':4A,40B,72C 'behavior':53B,79C 'caus':49B,60B 'citrix':1A,22B,42B,85C,89C 'citrix-netscal':21B 'cve':11A,14A 'denial':8A,62B,81C 'enabl':7A 'erron':52B,78C 'flaw':55B 'gateway':20A,30B,47B,91C 'host':34B 'infrastructur':24B 'lead':74C 'memori':5A,36B,68C 'netscal':2A,23B,26B,29B,43B,46B,86C,90C 'netscaler':17A,19A 'netscaler-adc':25B 'netscaler-gateway':28B 'overflow':6A,37B,69C 'saml':3A,31B,39B,71C 'self':33B 'self-host':32B 'servic':10A,64B,83C 'unpredict':50B,76C 'use':58B","nicknames":[],"mitigations":[],"who_affected":"NetScaler ADC and NetScaler Gateway appliances configured with a SAML action are exposed. Citrix rates it CVSS v4 8.7, network-reachable with no privileges or user interaction, and the impact is denial of service (availability only). Appliances with no SAML action configured can skip it, but the same bulletin lists many other CVEs fixed by the same builds.","tier":"B","verified":{"fix":{"at":"2026-11-13T03:44:49Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3814},"who_affected":{"at":"2026-11-13T03:44:49Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3814}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adc","gateway","netscaleradc","netscalergateway"],"ptokens":["adc","gateway","netscaler"],"labels":["citrixnetscaler","high","infrastructure","netscaleradc","netscalergateway","saml","selfhosted"],"campaign_type":null,"search_a":"'-107413':13A,16A '-2026':12A,15A 'adc':18A 'authent':4A 'citrix':1A 'cve':11A,14A 'denial':8A 'enabl':7A 'gateway':20A 'memori':5A 'netscal':2A 'netscaler':17A,19A 'overflow':6A 'saml':3A 'servic':10A","search_b":"'adc':27B,44B 'applianc':67B 'authent':40B 'behavior':53B 'caus':49B,60B 'citrix':22B,42B 'citrix-netscal':21B 'denial':62B 'erron':52B 'flaw':55B 'gateway':30B,47B 'host':34B 'infrastructur':24B 'memori':36B 'netscal':23B,26B,29B,43B,46B 'netscaler-adc':25B 'netscaler-gateway':28B 'overflow':37B 'saml':31B,39B 'self':33B 'self-host':32B 'servic':64B 'unpredict':50B 'use':58B","search_c":"'adc':87C 'authent':72C 'behavior':79C 'citrix':85C,89C 'denial':81C 'erron':78C 'gateway':91C 'lead':74C 'memori':68C 'netscal':86C,90C 'overflow':69C 'saml':71C 'servic':83C 'unpredict':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T03:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107413","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107413","severity":null,"published_at":"2026-11-13T03:17:28+00:00","modified_at":"2026-11-13T03:17:28+00:00","first_seen_at":"2026-11-13T03:42:55+00:00","fetched_at":"2026-11-13T03:42:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107413:3814","url":"https://support.citrix.com/external/article/CTX697305","severity":null,"published_at":"2026-11-13T03:44:49+00:00","modified_at":"2026-11-13T03:44:49+00:00","first_seen_at":"2026-11-13T03:44:49+00:00","fetched_at":"2026-11-13T03:44:49+00:00","note":"Read Citrix bulletin CTX697305: precondition is SAML action, heap overflow CWE-122, DoS, fixed builds listed. Affected lower bound not stated; no exploitation or PoC seen. Exa/X searches not run for discussion.","cites":["https://support.citrix.com/external/article/CTX697305"]}],"documents":[{"id":142058,"url":"https://support.citrix.com/external/article/CTX697305","title":"Citrix NetScaler ADC and Gateway Security Bulletin (CTX697305)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}