CVE-2026-107413: Memory overflow in SAML authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway

Key facts

Vendor rating

High, CVSS 8.7

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N · base score 8.7, scored by NetScalerAttack vector: network. Attack complexity: low. Attack requirements: none. Privileges required: none. User interaction: none. Confidentiality impact on the vulnerable system: none. Integrity impact on the vulnerable system: none. Availability impact on the vulnerable system: high. Confidentiality impact on subsequent systems: none. Integrity impact on subsequent systems: none. Availability impact on subsequent systems: none.

EPSS

0.31% chance of exploitation in the next 30 days (23rd percentile). FIRST EPSS, Nov 13, 2026.

CISA KEV

Not listed (catalogue checked Nov 15, 2026)

Affected

ADC before 14.1-73.57; ADC before 13.1-64.39; ADC before 14.1-73.58 FIPS and 3 more below

Fixed in

14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS and 1 more below

Source published

Nov 13, 2026

Listed by VulniPulse

Nov 13, 2026

Compiled by VulniPulse from the linked sources. How records are collected and checked.

More NetScaler (Citrix) advisories

• CVE-2026-107412Nov 13, 2026Multiple Memory overflow
• CVE-2026-107411Nov 13, 2026Memory overflow in RTSP ALG
• CVE-2026-107410Nov 13, 2026Memory overflow in NetScaler Push
• CVE-2026-107409Nov 13, 2026Memory corruption in DNS-over-HTTPS (DoH)
• CVE-2026-107408Nov 13, 2026Memory corruption in DNS / DNS-over-HTTPS (DoH)
• CVE-2026-107407Nov 13, 2026Memory overflow in SMPP traffic

NetScaler (Citrix) advisories, November 2026All NetScaler (Citrix) advisories