Loading vulnerability…
DNS/DoH Memory Corruption in Citrix NetScaler ADC and Gateway
CVE-2026-107408 is an out-of-bounds write vulnerability affecting DNS and DNS-over-HTTPS (DoH) processing in Citrix NetScaler ADC and NetScaler Gateway. Appliances configured for DNS load balancing with recursive DNS resolution are exposed. An unauthenticated network attacker can trigger memory corruption, potentially causing unpredictable or erroneous appliance behavior or denial of service. The vulnerability has a CVSS v4.0 score of 9.3. Affected releases include 14.1 before 14.1-73.57, 13.1 before 13.1-64.39, ADC 14.1-FIPS before 14.1-73.58, and ADC 13.1-FIPS and 13.1-NDcPP before 13.1-37.293.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause unpredictable or erroneous appliance behavior and denial of service, potentially disrupting DNS processing and services delivered through the affected appliance. Although the CVSS vector rates confidentiality, integrity, and availability impacts as high, specific outcomes such as arbitrary code execution or data disclosure have not been established.
If you can’t patch tonight, do this now.
No vendor-provided interim workaround is documented. Review appliance configuration to identify DNS load balancing with recursive DNS resolution and prioritize exposed appliances for patching. Configuration assessment is not a substitute for installing the fixed release.
Patch, then assume compromise.
Upgrade NetScaler ADC and NetScaler Gateway to 14.1-73.57 or later, or 13.1-64.39 or later within the 13.1 branch. For NetScaler ADC 14.1-FIPS, upgrade to 14.1-73.58 FIPS or later; for ADC 13.1-FIPS and 13.1-NDcPP, upgrade to 13.1-37.293 or later in the applicable branch. Upgrade both nodes of high-availability pairs and affected customer-managed NetScaler instances used in Secure Private Access hybrid deployments. Follow Citrix bulletin CTX697305 for upgrade guidance.
No public exploits tracked yet. Mallory keeps watching.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.