-
Citrix has released security updates for six vulnerabilities affecting NetScaler ADC and NetScaler Gateway deployments.
-
The flaws could allow attackers to read sensitive files, trigger memory-related issues, or launch denial-of-service attacks under certain configurations.
-
Citrix has not detected active exploitation, but researchers and the company urge organizations to install the updates immediately.
Citrix has rolled out security updates to address six vulnerabilities affecting NetScaler ADC and NetScaler Gateway appliances. The company warned that attackers could exploit the flaws to access sensitive files and trigger memory overreads.
They can even crash vulnerable systems with denial-of-service (DoS) attacks. Citrix said it has no evidence that threat actors are exploiting the bugs. However, it urged administrators to deploy the fixes promptly because internet-facing NetScaler appliances remain attractive targets for cybercriminals.
The vulnerabilities affect several NetScaler deployments running services. These include SAML Identity Provider (IdP), Gateway, AAA virtual servers, DNS Proxy, Oracle load balancing, recursive DNS resolver, and HTTP/2.
According to Citrix’s security advisory, organizations should also review their appliance configurations after installing the updates. The reason is that one of the flaws requires an additional manual mitigation to provide complete protection.
Six Flaws Target Multiple NetScaler Services
Citrix assigned the highest severity rating to three of the vulnerabilities, each carrying a CVSS score of 8.8. CVE-2026-8451 affects NetScaler appliances configured as SAML Identity Providers. Attackers can exploit improper input validation by sending specially crafted authentication requests that trigger memory overreads.
Another critical issue, CVE-2026-8452, can create memory overflow conditions when NetScaler operates as a Gateway or AAA virtual server. Those conditions may lead to unstable behavior or service outages. Citrix also resolved CVE-2026-8655, including multiple memory overflow vulnerabilities affecting Oracle load balancing, DNS Proxy, and recursive DNS resolver deployments.
The company also patched CVE-2026-10816, a vulnerability with a CVSS score of 7.7 that could let unauthenticated attackers read arbitrary files if management interfaces, including NSIP, Cluster Management IP, or SNIP, remain exposed. Citrix addressed CVE-2026-10817, involving a memory overread related to TCP TimeStamp processing, and CVE-2026-13474, which allows specially crafted HTTP/2 requests. They trigger denial-of-service conditions.
Citrix released fixes for supported NetScaler versions. These include NetScaler ADC and Gateway 14.1-72.61, 13.1-63.18, 14.1-FIPS 14.1-72.61, and 13.1-FIPS or 13.1-NDcPP 13.1.37.272 and later. Administrators running HTTP/2 without HTTP Strict Profiles must also manually set the Http2SmallWndTimeout parameter to 30 seconds. Installing the update alone will not completely mitigate CVE-2026-13474.
Researchers Link New Bug to Earlier NetScaler Weakness
Security researchers from JPMorgan Chase’s XOR team, watchTowr Labs, and independent researcher Maxim Suhanov responsibly disclosed the vulnerabilities. Alongside Citrix’s advisory, watchTowr Labs published a technical analysis. It explained that CVE-2026-8451 stems from the same underlying weakness as CVE-2026-3055, another critical NetScaler vulnerability disclosed earlier this year.
According to watchTowr researcher Aliz Hammond, the latest flaw leaks less memory than its predecessor. This is because certain control characters interrupt the read operation sooner. However, Hammond explained that the core weakness remains unchanged. She added that repeated discoveries suggest NetScaler appliances continue to suffer from memory management issues.
Attackers actively exploit such vulnerabilities, hackers have recently claimed attacks on organizations like Coast Appliances, though data leaks remain unconfirmed. She also noted that seemingly minor configuration mistakes can still expose sensitive memory contents under the right conditions.
Organizations Should Patch Before Attackers Move in
NetScaler appliances keep attracting sophisticated threat groups as they often sit beside enterprise networks and control access to business systems. Security experts repeatedly linked unpatched NetScaler vulnerabilities to ransomware intrusions, credential theft, and data exfiltration campaigns over the years past.
Although Citrix has not reported active exploitation, security professionals warn that attackers frequently reverse engineer vendor patches shortly after release. They intend to identify vulnerable systems. Organizations should therefore treat these updates as high priority and install the latest releases.
They should also restrict access to management interfaces, verify HTTP/2 configurations, and remove unnecessary administrative exposure. Acting quickly remains the best defense before opportunistic attackers begin scanning for unpatched NetScaler deployments.
