CISA put 107406 on the NetScaler alert. 73.41 is still in.

CVE-2026-107406 is RCE or DoS on SAML. The 88779 floor is inclusive for IdP. Citrix is not aware of exploits. It is not on KEV.

RWP Ventures · 2026-10-10 · event 2026-10-08 · 15 min read · priority 8.8

The product is customer-managed Citrix NetScaler ADC and NetScaler Gateway. The bug is a memory overflow (CWE-119) that Citrix classifies as remote code execution or denial of service. CNA score is 9.5 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L. Attack complexity is High. Privileges required are None. Precondition is SAML, with a version split: older builds are in as SAML SP or IdP; the 88771/88779 band is in only as SAML IdP.

Do not collapse four facts.

1. This is not last week’s KEV and it is not on today’s catalog. KEV freeze is still 2026.10.08 / 1739, released 8 October 20:09 UTC. Newest rows remain the five Integrity Tech Appendix B CVEs from [yesterday’s Daily Top](/posts/2026-10-09-integrity-tech-aa26-281a-kev/). CVE-2026-107406 is not in that JSON. CISA put it on the NetScaler alert. That is amplification, not a known-exploited listing.
2. 14.1-73.41 / 13.1-64.28 is still in if the box is a SAML IdP. Those were the [5 October](/posts/2026-10-05-netscaler-cve-2026-88779-kev/) floors for CVE-2026-88779. CTX697191 lists 14.1-73.37 through 14.1-73.41 inclusive (and the matching 13.1 / FIPS band) as affected when configured as a SAML IdP. The new floor is 14.1-73.46 / 13.1-64.29 / 14.1-73.46 FIPS / 13.1.37.283. ACSC’s sentence is the operator ticket: the earlier ISOs do not close this CVE.
3. Citrix has not confirmed exploitation of 107406. Community blog, last updated 8 October 17:00 PDT: “Citrix is not aware of any unmitigated exploits of this vulnerability.” MS-ISAC 2026-110 (8 October): “There are currently no reports of the vulnerability for CVE-2026-107406 being exploited in the wild.” Treat CISA-ADP “exploitation none” on the NVD record as consistent with that. Do not read the alert title (“Zero-Day Vulnerabilities Exploited”) as a finding against this CVE. 88771, 88772, and 88779 are the exploited set on that page.
4. This is not Integrity Tech and not FortiBleed. Yesterday was AA26-281A and a five-row KEV add, due 11 October. 8 October Daily Top was FortiBleed. Different product, different mechanism.

What happened

Sunday 27 September, Citrix published CTX697096 for CVE-2026-88771 through CVE-2026-88778. CISA put 88771 and 88772 on KEV the same day. Operators who could, moved to 14.1-73.37 / 13.1-64.23. Mandiant named WHIPSHOT / SLAPSHOT on 88772. That ticket did not close.

Friday 3 October / Saturday 4 October, CVE-2026-88779 became a second SAML overflow, CTX697174, floors 14.1-73.41 / 13.1-64.28. CISA added it to KEV. Our [5 October Daily Top](/posts/2026-10-05-netscaler-cve-2026-88779-kev/) was that row. Citrix classified 88779 as DoS. CISA’s 9 October alert text now also says unpatched boxes may use 88779 to force a reboot and accelerate code previously injected through 88771.

Thursday 8 October, Citrix published a third SAML-path bulletin. CTX697191 assigns CVE-2026-107406. Citrix credits Joshua Foote, Michael Tucker, and Eugene Lim of the XOR Team at JPMorgan Chase. NVD published the record 8 October, last modified 9 October. CISA revised the 27 September alert on 9 October to (1) include 107406, (2) include 88779 after the 4 October KEV add, (3) clarify the 88779/88771 relationship, and (4) emphasize patching 88771 through 88779 and 107406. ACSC reviewed the same day: previous patches are not enough.

CTX697191 (Critical): memory overflow leading to remote code execution or denial of service. Customer-managed ADC and Gateway only. Citrix-managed cloud services and Citrix-managed Adaptive Authentication are out of the customer bulletin; Citrix says it upgrades those itself. Secure Private Access Hybrid deployments that use NetScaler instances are in.

Config check Citrix published (same strings as 88779):

add authentication samlAction

or

add authentication samlIdPProfile

Version-specific precondition, not a slogan:

A 73.41 SAML SP that never became an IdP is not this CVE on Citrix’s table. A 73.41 SAML IdP is. A box still below 73.37 is in for 88771, 88779, and 107406.

BleepingComputer’s 9 October 04:27 write-up is how most SOCs will see the third ISO. Shadowserver’s exposed-NetScaler counts (about 21,000 fingerprints) are internet census, not a vulnerable-and-SAML inventory. The CISA alert, CTX697191, and the ACSC review are the primary.

Why it matters

Last week’s NetScaler work assumed 73.41 was the SAML floor. For IdP it is not.

Three operational lies are in the ticket this morning.

1. “We patched 88779, so the CISA NetScaler alert is not us.” False if the running build is 73.37–73.41 (or 64.23–64.28) and samlIdPProfile is in the config. False, period, if the box never made 73.37. CISA put 107406 on the same alert so operators would not stop at the previous ISO.
2. “CISA put it on the exploited-zero-day page, so 107406 is confirmed in the wild.” False on the current record. The page already hosted 88771/88772/88779. The 9 October revision includes 107406 and tells you to patch it. It does not add the CVE to KEV. Citrix and MS-ISAC both say they have no exploitation reports for this identifier.
3. “9.5 means unauthenticated default-config RCE like 88771.” False. 88771 needed no extra feature. 107406 needs SAML, and on the already-patched band it needs IdP. Attack complexity on the CNA vector is High. Availability, confidentiality, and integrity are all High if the overflow is reached. That is not 88771.

A NetScaler in front of an industrial site is still an IT identity/edge problem on this record. No source in this assessment claims process impact from 107406.

Who / what is affected

This CVE is not 88773–88778. Those remain on CTX697096. They are not on KEV in freeze 2026.10.08.

Technical context

RWP is not reproducing SAML payloads or overflow primitives. Citrix’s published defender cut is enough: a memory-buffer overflow on the SAML SP/IdP path, unauthenticated, that the CNA says can take the service down or run code. Attack complexity High on CVSS 4.0. That is a different vector from 88779 (availability High, C/I None, AC Low) and from 88771 (command execution, no SAML gate).

What to inventory and hunt, from vendor and IR writing — configs, builds, and crash evidence, not an exploit path:

• Running build (show ns version) against CTX697191, not against last week’s 73.41 spreadsheet.
• Config strings add authentication samlAction and add authentication samlIdPProfile. On 73.37–73.41, IdP is the 107406 gate. Presence is exposure on an affected build, not proof of compromise.
• Whether the box was ever below 73.37 / 64.23 in September. 107406 does not retire [WHIPSHOT / SLAPSHOT](/posts/2026-09-30-netscaler-whipshot-slapshot/).
• Unexpected NSPPE / authentication-daemon crashes. A crash on a 73.41 IdP after 8 October is 107406-shaped only as a hunting lead. It is not attribution.
• Citrix IoC scan in NetScaler Console remains the vendor first-pass for 88771/88772. A clean scan is not proof.
• Forward NetScaler logs off-box. CISA’s standing note on this alert: local logs rotate and an ISO can destroy artifacts.

ATT&CK mapping for the ticket, not a kill chain we ran:

No public proof-of-concept for 107406 is used in this assessment. We will not publish one.

Threat / exploitation status

Confidence on the bulletin, the new floors, the SAML/IdP split, the CISA alert revision, the ACSC sentence, and the absence of this CVE from KEV: high. Confidence that 107406 is under active exploitation: low on the current vendor, MS-ISAC, and catalog record. Confidence that every 73.41 box is in: low — IdP is the gate Citrix described for that band. Confidence that Citrix-managed cloud is patched: moderate (vendor statement only).

What defenders should do

1. Inventory every customer-managed ADC and Gateway — HA peer, SDX instance, DR, lab, FIPS, NDcPP, SPA Hybrid. Record show ns version against CTX697191. Then grep the saved config for samlIdPProfile and samlAction. In scope for the 73.37–73.41 / 64.23–64.28 band = IdP. In scope below 73.37 / 64.23 = SAML SP or IdP. No SAML strings = not this CVE; still check 88771.
2. If in scope: snapshot, then upgrade. The close is 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS, or 13.1.37.283 — not 73.41. Citrix has not published a workaround that replaces the ISO. Preserve newnslog, authentication logs, and a config copy off-box before the window.
3. Do not declare a 73.41 IdP clean because 88779 is closed. That build is on CTX697191’s inclusive IdP list. If September exposure is unknown, follow CTX694799 and the [30 September hunt](/posts/2026-09-30-netscaler-whipshot-slapshot/). PHP in unexpected web roots, SUID /bin/sh, HA-sync of attacker files — those survive a third SAML ISO.
4. If the box is still below 73.37 / 64.23: that is three bulletins, two of them KEV RCE. 88771 remains unauthenticated command execution on default config. Pull it off the internet or get to 73.46 (which includes all three floors) before you argue about SAML IdP vs SP.
5. Hunt 88779-shaped reboots on unpatched 88771 boxes as a separate ticket. CISA’s 9 October clarification is about forcing a reboot to fire previously injected 88771 code. That chain is not a finding that 107406 is in the wild. It is a reason the old RCE floor still matters.
6. Keep yesterday’s KEV clock on the board. ProFTPD CVE-2015-3306, BIND CVE-2015-5477, Struts CVE-2016-3081, ONLYOFFICE CVE-2021-3199, and Strapi CVE-2023-22894 are due 11 October. SoftEther named conhost.exe / dllhost.exe is still the persistence in AA26-281A. The SAML Gateway is this morning’s interrupt; that catalog did not pause.

RWP assessment

Score 8.8.

Highest-leverage development since yesterday’s Integrity Tech piece is a new Critical SAML overflow on the same perimeter product, with CISA and ACSC telling operators the previous floors do not close it. Evidence quality is high on CTX697191, the 9 October CISA revision, the ACSC sentence, CVE/NVD, and the KEV JSON showing this identifier absent (CISA alert, vendor bulletin, national CERT, catalog freeze). Evidence quality is intentionally split on exploitation of 107406 itself: Citrix and MS-ISAC say none reported; CISA amplified the patch without a KEV row.

It outranks a second day on AA26-281A because yesterday already assessed the seizure, SoftEther persistence, and the five KEV adds; today’s catalog is unchanged at 2026.10.08 / 1739, and the due date is tomorrow, not a new exploitation picture. It outranks Atlassian CVE-2026-21589 scanning because that was Daily Top on 6 October and is still not on KEV. It outranks the Qilin extradition/arrest reporting (Japan → Germany, 9 October) because an arrest is not a defender ticket on an internet-facing ADC. It outranks GitLab AI Gateway CVE-2026-90970 (CVSS 9.9, authenticated Duo Agent, hosted gateways already patched, no exploitation claimed). It outranks FortiMail CVE-2026-104286 because FG-IR-26-175’s 7 October note is a Cloud-fix clarification on a KEV we already ran 2–4 October.

What we are not saying: that 107406 is on KEV; that Citrix confirmed in-the-wild use; that 73.41 is out for IdP; that every NetScaler is in; that a SAML SP on 73.41 is in; that 107406 is 88771; that a Gateway in front of a plant is confirmed process impact; that Citrix-managed cloud is independently verified patched; that the Integrity Tech due date moved.

What we are watching

• Whether CISA adds CVE-2026-107406 to KEV. That would be a material development.
• Whether Citrix or a national CERT reports unmitigated exploits of 107406.
• Whether 73.46 / 64.29 actually install across HA/SDX estates, or stall behind the last two ISOs.
• Whether 88773–88778 pick up exploitation and join KEV.
• Integrity Tech five-row KEV due 11 October — [yesterday’s ticket](/posts/2026-10-09-integrity-tech-aa26-281a-kev/), still open.
• Apple CVE-2026-86950 due 13 October.
• Whether a public PoC for 107406 appears. We will not publish one.

Sources

• CISA — Critical zero-day vulnerabilities exploited in Citrix NetScaler ADC, Gateway (revised 9 October 2026)
• Citrix CTX697191 — CVE-2026-107406
• Citrix — Immediate guidance for CVE-2026-107406
• Citrix CTX697174 — CVE-2026-88779
• Citrix CTX697096 — CVE-2026-88771 through CVE-2026-88778
• Citrix CTX694799 — steps if NetScaler ADC is suspected compromised
• ASD’s ACSC — Citrix NetScaler ADC and Gateway (reviewed 9 October 2026)
• CISA — KEV JSON catalog 2026.10.08
• CISA — Known Exploited Vulnerabilities Catalog
• CVE-2026-107406 · NVD
• MS-ISAC 2026-110
• BleepingComputer — Citrix warns admins to patch new NetScaler RCE
• Network World — Citrix weekly critical NetScaler patch
• The Register — another critical NetScaler reason to patch
• Beazley Security — CVE-2026-107406
• [RWP — NetScaler 88779 KEV Daily Top, 5 October 2026](/posts/2026-10-05-netscaler-cve-2026-88779-kev/)
• [RWP — Integrity Tech AA26-281A Daily Top, 9 October 2026](/posts/2026-10-09-integrity-tech-aa26-281a-kev/)
• [RWP — WHIPSHOT/SLAPSHOT Daily Top, 30 September 2026](/posts/2026-09-30-netscaler-whipshot-slapshot/)
• [RWP — NetScaler 88771/88772 KEV Daily Top, 28 September 2026](/posts/2026-09-28-citrix-netscaler-cve-2026-88771-88772-kev/)