A memory overflow flaw in NetScaler ADC and NetScaler Gateway allows a remote attacker to execute arbitrary code or cause a denial of service. The vulnerability arises when the device is configured as a SAML Service Provider or Identity Provider, and buffer overflow is triggered during SAML processing. Based on the description, it is inferred that exploited traffic targets the SAML protocol handling components.

NetScaler ADC and NetScaler Gateway are affected when operating as either a SAML SP or SAML IdP. All versions up to and including 14.1‑73.41 (and all earlier releases) are impacted, as well as the corresponding FIPS releases up to and including 14.1‑73.41 FIPS. The 13.1 product line is vulnerable up to and including 13.1‑64.28, and 13.1‑37.282 FIPS (and all earlier 13.1 releases). Any device whose firmware falls within these ranges, regardless of role, must be remediated.

The CVSS score of 9.5 indicates a very high severity, and the EPSS score of 2% suggests a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, yet the availability of remote code execution warrants a precautionary approach. The likely attack vector is through SAML traffic or configuration handling, meaning that remote actors able to influence SAML interactions can exploit the overflow.