Citrix NetScaler SAML Critical RCE CVE-2026-107406: The Oct 3 Fix Sits Inside the Oct 8 Affected Range

The release of CTX697191 on October 8, 2026, marks the second emergency patch for Citrix NetScaler SAML configurations. This cycle confirms a recurring operational failure: the very builds deployed to secure the appliance against the previous vulnerability are now identified as vulnerable to a more severe exploit. The new vulnerability, CVE-2026-107406 , is a critical memory overflow (CWE-119) affecting appliances configured as SAML Service Providers or Identity Providers. Unlike the previous issue, which was limited to denial of service, this vulnerability carries an impact of remote code execution or denial of service. The CVSS v4.0 score is 9.5 (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L). Citrix reports no unmitigated in-the-wild exploitation and no public proof-of-concept at the time of disclosure. The operational trap documented in Post 131871 has repeated.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to Forkast.