Critical Citrix NetScaler ADC and Gateway Bugs Allow DoS, Memory Overflow

Key Takeaways

• Multiple critical vulnerabilities have been discovered in Citrix NetScaler ADC and Gateway products.
• These flaws, including CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, and CVE-2026-13474, could lead to denial-of-service (DoS) and memory overflow attacks.
• Affected versions include NetScaler ADC and Gateway 14.1 prior to 14.1-72.61, and 13.1 prior to 13.1-63.18, along with specific FIPS builds.
• Citrix has released patches, and immediate upgrades are strongly advised for all self-managed deployments.

Critical Flaws Found in Citrix NetScaler ADC and Gateway

Cloud Software Group has disclosed several high-severity vulnerabilities impacting its Citrix NetScaler ADC and NetScaler Gateway products. These security defects could enable attackers to launch denial-of-service (DoS) attacks and exploit memory overflow conditions, potentially disrupting critical network services.

The six vulnerabilities, identified as CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, and CVE-2026-13474, were detailed in a security bulletin released on June 30, 2026. The affected systems include various supported versions of NetScaler ADC and Gateway appliances.

Affected Versions and Impact

Specifically, the vulnerabilities affect NetScaler ADC and Gateway versions 14.1 before 14.1-72.61, and 13.1 before 13.1-63.18. Additionally, NetScaler ADC FIPS versions preceding 14.1-72.61 FIPS and 13.1-37.272 are also susceptible. Organizations utilizing Secure Private Access Hybrid deployments that incorporate NetScaler instances are also at risk.

These flaws primarily arise from inadequate memory handling and insufficient input validation mechanisms within the software. Attackers could exploit these weaknesses by sending specially crafted requests to vulnerable endpoints, triggering memory overflow states. This could lead to system crashes, resource exhaustion, and ultimately, a complete disruption of services, even by unauthenticated threat actors.

Significance of the Vulnerabilities

Cybersecurity experts emphasize the particular danger posed by vulnerabilities in edge devices like NetScaler ADC and Gateway. These devices are fundamental components of enterprise networks, commonly functioning as load balancers, VPN gateways, and application delivery controllers. A successful DoS attack against such infrastructure can result in widespread outages, impacting essential business applications, remote access capabilities, and customer-facing services.

While there is currently no public evidence indicating active exploitation of these specific vulnerabilities, their high severity rating underscores a significant potential risk. Historically, network edge appliances are frequently targeted by threat actors due to their direct exposure to the internet and their pivotal role in maintaining enterprise operations. Similar vulnerabilities in the past have often been rapidly weaponized once publicly disclosed.

What You Should Do

• Immediate Patching: Upgrade NetScaler ADC and Gateway instances to version 14.1-72.61 or later, and 13.1-63.18 or later. FIPS and NDcPP builds must also be updated to their corresponding secure versions. Refer to the Security Bulletin CTX696604 for detailed instructions.
• Verify Scope: Note that this bulletin applies to customer-managed NetScaler deployments. Citrix-managed cloud services and Adaptive Authentication platforms have already been updated by Cloud Software Group.
• Proactive Monitoring: Implement continuous monitoring for unusual network traffic patterns, unexpected service interruptions, or repeated failed connection attempts, as these could indicate attempted exploitation.
• Enhance Network Defenses: Utilize network segmentation to isolate critical services and implement rate limiting to mitigate the impact of potential denial-of-service attacks.
• Review Logs: Regularly review system logs for any anomalies or indicators of compromise.