Loading story…
Citrix published a security advisory for NetScaler ADC and NetScaler Gateway, warning that multiple high-severity vulnerabilities can be exploited remotely in specific deployments and configurations. The advisory, highlighted by the Canadian Centre for Cyber Security, affects the 14.1 and 13.1 release lines as well as certain NetScaler FIPS and NDcPP editions, and references six CVEs including CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, and CVE-2026-13474. Administrators were urged to review Citrix’s bulletin and move affected systems to fixed versions.
The disclosed flaws include a malformed HTTP/2 request issue that can trigger denial of service when HTTP/2 is enabled on affected LB, CS, VPN virtual servers or services (CVE-2026-13474); multiple memory overflow vulnerabilities tied to Oracle load balancer, DNS proxy, and DNS recursive resolver deployments (CVE-2026-8655); a memory overread caused by insufficient input validation when NetScaler is configured as a SAML Identity Provider (CVE-2026-8451); and a separate memory overflow vulnerability affecting Gateway or AAA virtual servers, including SSL VPN, ICA Proxy, CVPN, and RDP Proxy deployments (CVE-2026-8452). Recommended mitigations include applying Citrix security updates, disabling HTTP/2 or vulnerable Gateway features where not required, reviewing exposed virtual server and HTTP profile configurations, and monitoring for anomalous behavior.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
In reporting on the NetScaler vulnerabilities, Citrix stated that its managed cloud services and Adaptive Authentication platforms had already been updated, while customer-managed deployments were urged to upgrade. This adds a vendor response detail beyond the initial advisory and fixed-version guidance.
On 2026-06-30, the Canadian Centre for Cyber Security published alert AV26-645 highlighting Citrix's NetScaler advisory and urging users and administrators to review the bulletin and apply the necessary updates. It noted that affected products remain vulnerable until updated to the fixed versions.
Citrix said some deployments affected by CVE-2026-13474 require not only upgrading to fixed NetScaler versions but also manually configuring Http2SmallWndTimeout to fully address the HTTP/2 denial-of-service issue. The company also stated it had no evidence of in-the-wild exploitation at the time of disclosure.
CVE-2026-13474 was disclosed as a high-severity denial-of-service vulnerability affecting NetScaler ADC and NetScaler Gateway when HTTP/2 is enabled in an HTTP Profile tied to certain virtual servers or services. The issue can be triggered remotely through malformed HTTP/2 requests.
CVE-2026-8655 was disclosed as multiple memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway that can lead to erroneous behavior and denial of service. Exploitation is possible when NetScaler ADC is configured as an Oracle load balancer, DNS proxy, or DNS recursive resolver.
CVE-2026-8452 was disclosed as a high-severity memory overflow vulnerability in NetScaler ADC and NetScaler Gateway affecting Gateway or AAA virtual server deployments, including SSL VPN, ICA Proxy, CVPN, and RDP Proxy. The flaw can cause unpredictable behavior or denial of service and is described as remotely exploitable.
CVE-2026-8451 was disclosed as a high-severity insufficient input validation flaw that can cause memory overread in NetScaler ADC and NetScaler Gateway when configured as a SAML Identity Provider. The issue is described as remotely exploitable and vendor fixes were recommended.
On 2026-06-30, Citrix published a security advisory for NetScaler ADC, NetScaler Gateway, and certain NetScaler FIPS and NDcPP editions. The advisory covered affected 14.1 and 13.1 release lines and referenced CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, and CVE-2026-13474, with updates identified as the remediation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethehackernews.com
Open sourcecyberscoop.com
Open sourcecyber.gc.ca
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcelabs.beazley.security
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citrix released security updates to address multiple vulnerabilities affecting **Citrix XenServer**, **NetScaler ADC**, and **NetScaler Gateway**, warning that the flaws could lead to denial-of-service conditions, memory corruption, disclosure of sensitive information, arbitrary code execution, and unauthorized access. The update was highlighted by EG-FinCIRT, which said organizations should apply the fixes after completing testing. The most prominent issues are **`CVE-2026-8451`** and **`CVE-2026-8452`**, both affecting NetScaler ADC and NetScaler Gateway and each assigned a **CVSS 4.0 score of 8.8**. EG-FinCIRT described `CVE-2026-8451` as an insufficient input validation flaw and `CVE-2026-8452` as a race condition vulnerability, underscoring the risk to internet-facing Citrix infrastructure commonly used for application delivery and remote access.
Jul 14, 2026
Citrix disclosed critical vulnerabilities affecting **NetScaler ADC** and **NetScaler Gateway**, prompting alerts from both the Canadian Centre for Cyber Security and CERT-EU. The issues are tracked as `CVE-2026-3055` and `CVE-2026-4368`, and impact multiple supported release branches, including **14.1**, **13.1**, and **13.1 FIPS/NDcPP** versions running below the vendor’s fixed builds. Affected deployments include standard **NetScaler ADC**, **NetScaler Gateway**, and hardened **FIPS/NDcPP** editions. Government cyber authorities urged organizations to review Citrix’s security bulletin and apply the recommended updates and mitigations without delay. The coordinated advisories indicate broad concern across enterprise and public-sector environments that rely on Citrix application delivery and remote access infrastructure, with administrators advised to identify exposed appliances and move vulnerable systems to patched versions listed by Citrix.
Jul 1, 2026
Citrix NetScaler ADC and NetScaler Gateway appliances are affected by multiple critical vulnerabilities that can expose organizations to compromise, including `CVE-2025-5349`, `CVE-2025-5777`, and `CVE-2026-3055`. The flaws impact supported NetScaler releases, while end-of-life versions `12.1` and `13.0` remain vulnerable without fixes. `CVE-2025-5349` enables access-control bypass on the management interface, `CVE-2025-5777` is an out-of-bounds read that can leak sensitive memory contents, and `CVE-2026-3055` is an input-validation flaw that can lead to memory overwrite when NetScaler is configured as a SAML Identity Provider.
Jun 29, 2026