NetScaler ADC CVE-2026-107406

Exploitation requires the NetScaler ADC or NetScaler Gateway to be explicitly configured as a SAML Service Provider (SP) or SAML Identity Provider (IdP) - appliances not using SAML authentication are not affected. The exposure further depends on role and version: devices on 14.1-73.37 through 14.1-73.41, 13.1-64.23 through 13.1-64.28, and corresponding FIPS/NDcPP builds are vulnerable ONLY when acting as a SAML IdP, whereas any build before 14.1-73.37 / 13.1-64.23 (and FIPS equivalents) is vulnerable when acting as either a SAML SP OR IdP. No authentication is required (PR:N) and no user interaction (UI:N), but the AC:H rating indicates meaningful attack complexity - exploitation likely depends on specific memory conditions rather than being a deterministic single-shot trigger, which limits reliability and mass-scanning viability.

This is a genuine high-priority issue, though several real-world signals temper the raw 9.5 score. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N) indicates a network-reachable, unauthenticated flaw with full triple impact (VC:H/VI:H/VA:H), and the memory-overflow-to-RCE class on an internet-facing NetScaler edge appliance is historically a top target for mass exploitation. However, the vector also carries AC:H, meaning exploitation is not trivially reliable and likely requires winning a race or defeating memory-layout conditions, which usually slows weaponization. No EPSS score, no CISA KEV entry, and no POC were provided in the input, so there is no public evidence of exploitation yet - at the time of analysis this is 'no public exploit identified.' A critical limiting factor NOT reflected in the CVSS score is configuration dependency: the appliance must be configured as a SAML SP or SAML IdP, so environments not using SAML authentication are not exposed. Net assessment: treat as urgent patch priority for SAML-configured NetScaler deployments given the product's edge exposure and NetScaler's well-documented history of active exploitation, but note the real-world attack surface is narrower than the unconditional 9.5 implies.

A remote, unauthenticated attacker sends a crafted SAML message (or malformed authentication request) to an internet-facing NetScaler ADC or Gateway configured as a SAML SP or IdP, triggering a memory overflow in the SAML processing path. By carefully shaping the overflow the attacker achieves remote code execution on the appliance, or at minimum crashes the service for denial of service. The AC:H rating implies exploitation is not guaranteed on the first attempt and may require repeated tries or specific memory conditions; no public exploit code was identified in the provided data.