Citrix published security bulletin CTX697191 on October 8, 2026 for CVE-2026-107406, a CWE-119 memory overflow in NetScaler ADC and NetScaler Gateway rated CVSS v4.0 9.5. Successful exploitation can lead to remote code execution or denial of service. The vector is network, no privileges, no user interaction, with high attack complexity. Only appliances with particular SAML configurations are exposed.
Citrix said it was not aware of unmitigated exploits when the bulletin went out, and it has published no exploit details. Credit goes to Michael Tucker, Chew Keong Tan and Alex Bernier of the JPMorgan Chase XOR Team, plus Maxim Suhanov (per Cyber Security News).
What we'd do this afternoon: pull every internet-facing ADC and Gateway, check which ones act as a SAML SP or IdP, and move those to the fixed builds listed in CTX697191 first. Don't reuse the build numbers from last month's NetScaler SAML fixes, because they don't cover this bug. CVE-2026-19490 landed on CISA's KEV list in September, so plan for exploitation, not against it.