Actively Exploited Citrix NetScaler Denial-of-Service Vulnerability

Affected Environment
NetScaler ADC, Gateway, and FIPS builds before 14.1-73.41 or 13.1-64.28 configured as SAML SP or IdP.

Threat Overview
Actively exploited memory overflow vulnerability lets remote unauthenticated attackers cause denial of service on SAML-configured NetScaler appliances.

Exposure Timeline
Reported 4 October 2026 as actively exploited. Fixed builds 14.1-73.41 and 13.1-64.28 are available.

Attack Surface
NetScaler ADC and Gateway appliances configured as SAML Service Provider or Identity Provider, reachable by remote unauthenticated attackers.

Technical Root Cause
Memory overflow condition on appliances with a samlAction or samlIdPProfile configuration entry.

Exploitation Pathway
Remote unauthenticated attacker triggers the memory overflow on a SAML SP or IdP appliance, causing denial of service.