Summary
- NHS England amended its advisory for CVE-2026-107406 on 12 October.
- Several versions originally marked unaffected were moved into the affected list.
- The NHS recommends current fixed releases; the alert predicts exploitation but does not prove it has occurred.
NHS England has corrected a critical NetScaler vulnerability alert after discovering that several affected software releases had been incorrectly identified as safe. The amendment, issued on 12 October, changes the exposure assessment for organisations that checked their appliances against the original 9 October advisory.
The alert concerns CVE-2026-107406, a memory handling vulnerability affecting certain NetScaler ADC and Gateway deployments configured for Security Assertion Markup Language authentication. Successful exploitation could allow remote code execution or denial of service, according to the NHS notice. The flaw carries a CVSS version 4 score of 9.5.
In its revision, NHS England said NetScaler ADC and Gateway releases 14.1-73.41 and 13.1-64.28 had been incorrectly marked as not affected. NetScaler ADC 14.1-73.41 FIPS and 13.1-37.282 FIPS were also among the versions covered by the correction. Those releases must be treated as vulnerable under the conditions in the updated advisory.
The revision changes the list of affected releases for an already disclosed CVE; it does not introduce a new vulnerability. It is also separate from CVE-2026-88779, a different NetScaler flaw disclosed earlier in October. Treating the two findings as interchangeable would obscure differences in severity, exploit conditions, and the necessary software fixes.
Corrected release classifications
Security response depends on more than a vulnerability identifier. An organisation must determine whether its actual appliance version and configuration meet the conditions for exposure, whether the vendor has issued a corrected build, and whether any interim measures are available. A mistaken classification can cause a system to be left out of a patching programme despite remaining vulnerable.
NetScaler ADC and Gateway products often sit at network boundaries, supporting authentication and access to enterprise services. Some configurations act as SAML identity providers, others as service providers. The NHS alert specifies how those roles affect the conditions under which different releases can be attacked; merely installing NetScaler does not mean every installation has the same vulnerability path.
The advisory now lists fixed versions that include 14.1-73.46 and later, 13.1-64.29 and later, and corresponding corrected FIPS or NDcPP releases. For the 13.1 FIPS and NDcPP branches, the NHS identifies 13.1.37.283 and later. End-of-life 12.1 and 13.0 releases do not receive current security updates and require migration to supported versions.
Although the NHS warns that exploitation is likely, that is a forward-looking threat assessment. It refers in part to rapid exploitation seen against other recent NetScaler vulnerabilities. The publicly available notice does not establish that CVE-2026-107406 itself has been exploited against a named health organisation.
A previous compliance check against the 9 October affected-platform table could therefore need repeating. Organisations should use the corrected vendor bulletin and NHS version list rather than assuming that a previous green status is still valid. Updating inventory records and documenting which configurations depend on SAML can help explain why one device needs immediate action while another is outside the specific exposure conditions.
In healthcare, edge devices can support staff access and systems used for delivering services. A vulnerability that allows denial of service may therefore have operational consequences even if no patient database is accessed. Remote code execution raises a separate concern about control of the gateway and subsequent access, subject to how the appliance is deployed and what credentials it holds.
The revised alert also distinguishes between authentication roles. Some newer release ranges are vulnerable when configured as SAML identity providers, whereas other versions can be affected when acting as service providers or identity providers. That distinction makes an accurate configuration inventory necessary alongside version numbers. An organisation which recorded only that a device ran an earlier release may still need to establish precisely how the authentication service was configured.
The NHS published the original high-severity alert on 9 October and recorded the corrected platform classifications in its 12 October threat-update history. The fixed builds specified in the updated NHS notice and Citrix advisory now govern remediation.
