The 60-second summary
The 9 October 2026 ACSC update adds CVE-2026-107406 for NetScaler ADC and Gateway configured as a SAML service provider or identity provider. The memory-overflow issue can lead to remote code execution or denial of service. ACSC says earlier patches are insufficient and points to current vendor fixes. Recheck affected deployments and patch status. This is an updated security alert, not a new compliance deadline.
Timeline that matters
28 September 2026
9 October 2026
15 October 2026
What changed
A new SAML-dependent issue has been added to an existing alert.Earlier fixes do not resolve this issue; current vendor guidance is required.
Who should care
NetScaler administrators and infrastructure ownersIdentity, remote-access and application teamsIncident-response and privacy leadersManaged service providers supporting affected deployments
Why this matters for global organisations.
Remote-access and identity services can expose many downstream applications. Keep patch assurance tied to the current issue, configuration and installed build, and use incident evidence to decide whether further investigation is needed.
13 actions to start now
- Identify all managed NetScaler appliances, including secondary and disaster-recovery instances.
- Record accountable owners and support contacts for each instance.
- Document SAML roles and dependencies before choosing an update plan.
- Obtain the latest vendor bulletin and check exact affected and fixed builds.
- Record installed builds with timestamps and compare them to the current bulletin.
- Prioritise changes using exposure, downstream sensitivity and service criticality.
- Coordinate testing, rollback and maintenance arrangements with application owners.
- Apply the appropriate vendor fix and verify both members of resilient deployments.
- Validate authentication and application access after the change.
- Preserve available device and identity evidence when investigating suspicious activity.
- Escalate suspected compromise to specialists and obtain vendor-supported recovery advice.
- Assess downstream data access and notification duties if an incident is substantiated.
- Retain closure evidence and monitor further official bulletin revisions.
Evidence worth retaining
- Appliance/configuration inventory and owners
- Dated vendor bulletin and affected/fixed build assessment
- Pre- and post-change build evidence
- Change approval, rollback and authentication test records
- Investigation artefacts and visibility gaps
- Incident scope, notification decisions and closure approval
Questions to take to counsel or your conformity team
These are discussion prompts, not legal advice or conclusions.
- Does the precise SAML configuration and software build fall within the current vendor bulletin?
- Which applications and sensitive data depend on the affected service?
- What evidence can distinguish service instability from compromise?
- Does an affected deployment require further remediation beyond installing a fix?
- Who is responsible for managed-service patch verification and incident evidence?
Official sources
- ASD ACSC alert — published 28 September, updated 9 October 2026
- Citrix current security bulletin for CVE-2026-107406, linked by ACSC
PrivacyBuilt / PrivacyBuilt is an independent educational publisher. It is not affiliated with, or endorsed by, any regulator or the European Union.
PrivacyBuilt publishes educational and technical guidance. Nothing on this site constitutes legal advice, and it should not be relied on as a legal determination for your organisation.