CVE-2026-107406
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service
Updated
- CVSS 4.0
- 9.5 CRITICAL
- EPSS
- 1.9% (80th pct)
- CISA KEV
- Not listed
- Published
- 2026-10-08
- Weakness
- CWE-119
- CISA alert
- 2026-09-27
Description
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC. NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements: * For the following versions: Applicable only when configured as a SAML IdP: * NetScaler ADC and NetScaler Gateway between 14.1-73.37 and 14.1-73.41, inclusive * NetScaler ADC 14.1-FIPS between 14.1-73.37 FIPS and 14.1-73.41 FIPS, inclusive * NetScaler ADC and NetScaler Gateway between 13.1-64.23 and 13.1-64.28, inclusive * NetScaler ADC 13.1-FIPS between 13.1-NDcPP 13.1-37.279 and 13.1- 37.282, inclusive For the following versions: Applicable only when configured as a SAML SP or SAML IdP: * NetScaler ADC and NetScaler Gateway before 14.1-73.37 * NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS * NetScaler ADC and NetScaler Gateway before 13.1-64.23 * NetScaler ADC 13.1-FIPS before13.1-NDcPP 13.1-37.279
Key Findings
as of 2026-11-12- Its current EPSS score (1.9%) is higher than that of 7% of CISA KEV entries.
Severity
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:LOpen in CVSS calculator Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| NetScaler | NetScaler ADC | 0 to <14.1-73.46 0 to <13.1-64.29 0 to <14.1-73.46 FIPS 0 to <13.1.37.283 FIPS |
| NetScaler | NetScaler Gateway | 0 to <14.1-73.46 0 to <13.1-64.29 |
References
1 linksRecord Details
- Published
- 2026-10-08
- Last updated
- 2026-10-10
- Assigner (CNA)
- NetScaler
- Credited to
- -
More from NetScaler
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). Alert titles and links from CISA cybersecurity alerts. This site is not affiliated with or endorsed by MITRE, NVD, CISA, or FIRST.