Citrix Patches Critical NetScaler Flaw That Could Enable RCE in SAML Deployments

Citrix released patches for CVE-2026-107406, a critical memory overflow in NetScaler ADC/Gateway (CVSS 9.5) that can result in remote code execution or DoS when instances are configured as SAML IdP or SP; the advisory lists affected versions, fixed releases, and guidance to upgrade, and notes no evidence of exploitation for this CVE while other NetScaler flaws are actively exploited.