Infrastructure and authenticationCritical severity

SECURITY GUIDE

Memory Corruption and Remote Code Execution in Citrix NetScaler (CVE-2026-107406)

Examine how memory boundary flaws during SAML authentication parsing can lead to remote code execution on perimeter access gateways.

Areas to considerCitrix NetScaler ADCNetScaler GatewaySAML Identity Providers
01

THE CONTEXT

What to understand

CVE-2026-107406 is a critical buffer boundary restriction vulnerability impacting Citrix NetScaler ADC and Gateway appliances configured as SAML Service Providers or Identity Providers. During the parsing of malformed SAML authentication assertions and session cookie structures, a size calculation underflow allows unauthenticated memory corruption. Attackers can leverage the resulting memory instability to hijack program control flow within the packet handling daemon.

02

HIGH-LEVEL CONCEPT

How the risk can develop

This is a conceptual overview, not a procedure for reproducing an attack.

  1. An unauthenticated attacker sends an oversized or malformed SAML token to the gateway login endpoint.
  2. The parser calculates buffer allocations incorrectly, allowing payload bytes to exceed stack or heap boundaries.
  3. Process execution control is diverted, resulting in remote code execution with appliance privileges.
03

WHY IT MATTERS

Potential impact

Full system compromise of the network perimeter device, lateral movement across corporate networks, and interception of active user session tokens.

04

BE AWARE

Signals to monitor

  • Crash and core dump generation from the nsppe packet processing engine in appliance diagnostics.
  • Unexpected outgoing network connections initiated by appliance core processes.
  • Presence of anomalous cron jobs, webshell artifacts, or modified configuration scripts in /flash or /var.
05

PUT DEFENSE FIRST

Recommended defenses

  1. 01Install the latest firmware release from the vendor immediately across all ADC and Gateway instances.
  2. 02Place Web Application Firewall inspection in front of identity endpoints to block malformed SAML assertions.
  3. 03Isolate gateway management and internal interfaces with strict network segmentation.
  4. 04Continuously review appliance file integrity and process telemetry for signs of persistence.