Posted on

Citrix NetScaler CVE-2026-107406 SAML Memory Overflow — Sentinel Hunts

Threat Overview

Citrix disclosed CVE-2026-107406 on 8 October 2026, a CVSS v4 9.5 memory-overflow flaw in customer-managed NetScaler ADC and NetScaler Gateway when configured as a SAML service provider (SP) or identity provider (IdP). The version-specific SAML precondition matters: certain recently updated builds are vulnerable only in IdP mode, while older builds are vulnerable in either SP or IdP mode. The possible impact is remote code execution or denial of service. Citrix has not reported exploitation in the wild, and neither a verified exploit request signature nor campaign-specific IOCs were published in the cited advisory. The hunts therefore seek abnormal SAML-facing traffic, failures, crashes, and authentication changes; they are not CVE-specific exploit detectors.

References

Impacted Systems

  • Vendor/product: Citrix NetScaler ADC and NetScaler Gateway; customer-managed appliances and virtual deployments; also Secure Private Access Hybrid deployments using customer-managed NetScaler instances.
  • Affected 14.1 ADC/Gateway: versions before 14.1-73.37 when configured as SAML SP or IdP; 14.1-73.37 through 14.1-73.41 inclusive when configured as SAML IdP. Analogous 14.1-FIPS conditions apply.
  • Affected 13.1 ADC/Gateway: versions before 13.1-64.23 when configured as SAML SP or IdP; 13.1-64.23 through 13.1-64.28 inclusive when configured as SAML IdP. Analogous 13.1-FIPS/NDcPP conditions apply (pre-13.1-37.279 or 13.1-37.279–37.282 for IdP).
  • Fixed: 14.1-73.46+, 13.1-64.29+, 14.1-FIPS 14.1-73.46 FIPS+, and 13.1-FIPS/NDcPP 13.1.37.283+.
  • Configuration prerequisite: `add authentication samlAction` (SP) or `add authentication samlIdPProfile` (IdP), subject to the version-specific rules. Internet-exposed SAML endpoints raise external attack surface; the bulletin does not establish a required exploit URL or port.
  • Citrix-managed cloud services and Citrix-managed Adaptive Authentication are updated by Citrix; the bulletin concerns customer-managed instances.

Why this matters

Enterprise SSO/remote-access gateways are high-value, often Internet-facing infrastructure. The SAML IdP-only exposure of some recently patched builds makes simple major-version or patch-status checks insufficient.

Exploitation Status

Confirmed: vendor advisory and fixed builds. Vendor statement: no known exploitation in the wild as of the cited disclosure. Researcher assessment: generic request anomalies can suggest probing or denial of service but cannot prove CVE-2026-107406 exploitation.

What this hunt looks for

Prepared Sentinel hunts for SAML request volume and errors, perimeter connection anomalies, NetScaler service faults, configuration-change messages, and identity follow-on activity. No customer workspace was queried.

Required logs

Microsoft Sentinel tables, where ingested: AzureDiagnostics, CommonSecurityLog, SigninLogs, Syslog. Query results depend on appropriate collection, schema and retention.

1. First pass — unusual SAML-related traffic to gateways

CommonSecurityLog
| where TimeGenerated >= ago(7d)
| extend URI=tostring(column_ifexists("RequestURL","")), Product=tostring(DeviceProduct)
| where URI contains "saml" or Product has "NetScaler" or DeviceVendor has "Citrix"
| summarize Requests=count(), Blocked=countif(DeviceAction has_any ("deny","drop","block")), Destinations=dcount(DestinationIP), Ports=make_set(DestinationPort,8) by SourceIP, DestinationIP, bin(TimeGenerated,15m)
| where Requests >= 30 or Blocked >= 10
| order by Requests desc

2. SAML-path HTTP 5xx bursts in Azure WAF/application gateway

AzureDiagnostics
| where TimeGenerated >= ago(7d)
| extend URI=tostring(column_ifexists("requestUri_s","")), ClientIP=tostring(column_ifexists("clientIP_s","")), Status=tostring(column_ifexists("httpStatus_d","")), Method=tostring(column_ifexists("httpMethod_s",""))
| where URI contains "saml" and isnotempty(ClientIP)
| summarize Total=count(), ServerErrors=countif(Status startswith "5"), Methods=make_set(Method,6), Statuses=make_set(Status,10) by ClientIP, Resource, bin(TimeGenerated,15m)
| where ServerErrors >= 5 or Total >= 50
| order by ServerErrors desc

3. NetScaler appliance crashes and SAML failures in Syslog

Syslog
| where TimeGenerated >= ago(14d)
| where SyslogMessage has_any ("SAML","saml","nshttp","nsaaad","crash","core dump","segmentation","reboot")
| where Computer has_any ("netscaler","citrix") or SyslogMessage has_any ("NetScaler","nshttp","nsaaad","samlIdPProfile","samlAction")
| project TimeGenerated, Computer, ProcessName, SeverityLevel, SyslogMessage
| order by TimeGenerated desc

4. SAML gateway perimeter scanning across hosts

CommonSecurityLog
| where TimeGenerated >= ago(7d)
| extend URI=tostring(column_ifexists("RequestURL",""))
| where URI contains "saml" or DeviceProduct has "NetScaler"
| summarize Connections=count(), Destinations=dcount(DestinationIP), Ports=dcount(DestinationPort), SampleTargets=make_set(DestinationIP,10) by SourceIP, bin(TimeGenerated,1h)
| where Connections >= 50 and (Destinations >= 3 or Ports >= 3)
| order by Connections desc

5. SAML endpoint request concentration and failure statuses

AzureDiagnostics
| where TimeGenerated >= ago(7d)
| extend URI=tostring(column_ifexists("requestUri_s","")), ClientIP=tostring(column_ifexists("clientIP_s","")), Status=tostring(column_ifexists("httpStatus_d",""))
| where URI contains "saml" and isnotempty(ClientIP)
| summarize Requests=count(), Errors=countif(Status startswith "4" or Status startswith "5"), Paths=dcount(URI), Examples=make_set(URI,5) by ClientIP, Resource, bin(TimeGenerated,1h)
| where Requests >= 100 and Errors >= 20
| order by Errors desc

6. Citrix SAML configuration-change log indicators

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("samlAction","samlIdPProfile","authentication saml","SAML IdP","SAML SP")
| where SyslogMessage has_any ("add","set","bind","delete","remove","modified","changed","configured")
| project TimeGenerated, Computer, ProcessName, SeverityLevel, SyslogMessage
| order by TimeGenerated desc

7. Citrix application Entra sign-in IP diversity after anomalies

SigninLogs
| where TimeGenerated >= ago(7d)
| where AppDisplayName has_any ("Citrix","NetScaler")
| where tostring(ResultType) == "0"
| summarize Signins=count(), IPs=dcount(IPAddress), Countries=dcount(Location), SampleIPs=make_set(IPAddress,10), Apps=make_set(AppDisplayName,5) by UserPrincipalName, bin(TimeGenerated,1d)
| where IPs >= 3 and Countries >= 2
| order by IPs desc

Detection Notes

  • Highest signal: appliance-native crash/restart events correlated in time with SAML HTTP anomalies; unexplained successful SAML authentication after abnormal gateway failures. Neither alone proves exploitation.
  • AzureDiagnostics field names vary by resource and diagnostic mode. `requestUri_s`, `clientIP_s`, `httpStatus_d` and `httpMethod_s` must be populated for URL/status conclusions. Standard `CommonSecurityLog` may omit URL or status entirely.
  • SAML POST traffic and transient HTTP 5xx spikes can be legitimate during federation outages, maintenance or IdP changes. Restrict to known NetScaler IPs/FQDNs before interpreting results.
  • No published exploit URI, payload bytes, or malicious IPs are asserted. Syslog may not expose heap-overflow details, and appliances rarely support Microsoft Defender for Endpoint process telemetry.
  • Use 7–14-day lookbacks for immediate triage; historical analysis requires sufficient Sentinel retention.

Leave a Reply