All vulnerabilities
CVE-2026-107406

ADC: Memory overflow vulnerability leading to Remote Code Execution or Denial of Service

NetScaler ADCNetwork & edge
Open in ThreatlineRecord JSON
CVSS
9.5Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.47%Chance of exploitation activity in the next 30 days, higher than 39% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in14.1-73.46Also 13.1-64.29, 14.1-73.46 FIPS and 1 moreCVE List
Published8 Oct 2026Updated 10 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC.

NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements:

  • For the following versions: Applicable only when configured as a SAML IdP:
  • NetScaler ADC and NetScaler Gateway between 14.1-73.37 and 14.1-73.41, inclusive
  • NetScaler ADC 14.1-FIPS between 14.1-73.37 FIPS and 14.1-73.41 FIPS, inclusive
  • NetScaler ADC and NetScaler Gateway between 13.1-64.23 and 13.1-64.28, inclusive
  • NetScaler ADC 13.1-FIPS between 13.1-NDcPP 13.1-37.279 and 13.1- 37.282, inclusive

For the following versions: Applicable only when configured as a SAML SP or SAML IdP:

  • NetScaler ADC and NetScaler Gateway before 14.1-73.37 
  • NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS 
  • NetScaler ADC and NetScaler Gateway before 13.1-64.23
  • NetScaler ADC 13.1-FIPS before13.1-NDcPP 13.1-37.279

Text from CVE List

Affected versions 6

  • ADCaffected: all versions before 14.1-73.46CVE List
  • ADCaffected: all versions before 13.1-64.29CVE List
  • ADCaffected: all versions before 14.1-73.46 FIPSCVE List
  • ADCaffected: all versions before 13.1.37.283 FIPSCVE List
  • Gatewayaffected: all versions before 14.1-73.46CVE List
  • Gatewayaffected: all versions before 13.1-64.29CVE List

References 2