Critical Vulnerability in Citrix NetScaler ADC and Gateway

Affected Environment
NetScaler ADC and Gateway 14.1 and 13.1 configured as SAML SP or IdP; Secure Private Access Hybrid affected.

Threat Overview
A memory overflow flaw lets remote unauthenticated attackers potentially cause remote code execution or denial of service, with CVSS 9.5.

Exposure Timeline
Issued 9 October 2026. Citrix has released updates; exploitation is not confirmed in this report.

Attack Surface
NetScaler appliances configured as SAML Service Provider or Identity Provider, plus Secure Private Access Hybrid deployments.

Technical Root Cause
Memory overflow triggered on SAML-configured appliances; exposure depends on version and whether the appliance acts as SP or IdP.

Exploitation Pathway
Remote unauthenticated attacker triggers the memory overflow on a SAML-configured appliance, potentially executing code or crashing the service.