Cloud Software Group has disclosed six vulnerabilities affecting NetScaler ADC and NetScaler Gateway, several of which carry High severity ratings and could allow attackers to trigger denial-of-service conditions, read arbitrary files, or overread sensitive memory.
The bulletin, tracked as CTX696604, covers CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, and CVE-2026-13474.
The most severe issues, CVE-2026-8451 and CVE-2026-8452, each score 8.8 on the CVSSv4 scale. CVE-2026-8451 stems from insufficient input validation on appliances configured as a SAML IdP, enabling out-of-bounds memory reads (CWE-125). ‘
Citrix NetScaler ADC and Gateway Flaws
CVE-2026-8452 involves a memory overflow (CWE-119) affecting Gateway configurations (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual servers, leading to unpredictable behavior and DoS attacks.
CVE-2026-8655, also scored 8.8, affects appliances configured as an Oracle-type load balancer, DNS proxy, or DNS recursive resolver, again resulting in memory overflow and service disruption.
CVE-2026-13474 (CVSS 8.7) is particularly notable for HTTP/2 deployments. Malformed HTTP/2 requests can trigger a missing memory release condition (CWE-401), causing DoS on virtual servers with HTTP/2 enabled.
CVE-2026-10816 (CVSS 7.1) is an unauthenticated, arbitrary file-read vulnerability (CWE-73) that requires network access to the NSIP, Cluster Management IP, or SNIP with management access enabled.
CVE-2026-10817 (CVSS 6.9) causes a memory overread on appliances with TCP Timestamps enabled in an associated TCP profile.
Affected Versions
The flaws impact:
- NetScaler ADC and Gateway 14.1 before 14.1-72.61
- NetScaler ADC and Gateway 13.1 before 13.1-63.18
- NetScaler ADC FIPS before 14.1-72.61 FIPS
- NetScaler ADC FIPS and NDcPP before 13.1-37.272
Secure Private Access Hybrid deployments using NetScaler instances are also affected. Citrix stated that cloud services and Adaptive Authentication are patched automatically and fall outside the scope of this bulletin.
Cloud Software Group urges immediate upgrades to 14.1-72.61, 13.1-63.18, 14.1-72.61 FIPS, or 13.1-37.272 (FIPS/NDcPP), as applicable.
CVE-2026-13474 requires an additional manual step beyond patching. Administrators must configure the new Http2SmallWndTimeout parameter, which governs the timeout for stalled HTTP/2 small-window streams.
Appliances using HTTP Strict Profiles default to 30 seconds post-upgrade and are automatically protected.
Mitigation
Citrix provided configuration search strings to help teams confirm precondition exposure, such as checking for add authentication samlIdPProfile, add vpn vserver, add authentication vserver, Oracle/DNS-type LB or CS vserver entries, TimeStamp ENABLED in TCP profiles, and -http2 ENABLED on HTTP profiles (including the default nshttp_default_profile).
Cloud Software Group credited Michael Tucker (XOR team, JPMorgan Chase), Aliz Hammond (watchTowr), and Maxim Suhanov for responsible disclosure.
Given the network-exploitable nature and high CVSS scores across multiple CVEs, organizations running affected NetScaler builds should prioritize patching and the HTTP/2 configuration change to fully mitigate risk.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
