Loading vulnerability…
DNS-over-HTTPS Double Free in Citrix NetScaler ADC and Gateway
CVE-2026-107409 is a double-free memory-corruption vulnerability in the DNS-over-HTTPS (DoH) functionality of Citrix NetScaler ADC and NetScaler Gateway. It affects vulnerable appliances configured for DNS load balancing over HTTPS. An unauthenticated network attacker can trigger unpredictable or erroneous appliance behavior or denial of service without user interaction. The vulnerability has a CVSS v4.0 score of 9.3.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can cause abnormal appliance behavior or denial of service, potentially disrupting DNS resolution and services dependent on the affected appliance. Although the CVSS vector assigns high confidentiality, integrity, and availability impacts, remote code execution and specific data-disclosure or modification outcomes are not established.
If you can’t patch tonight, do this now.
No vendor-provided interim workaround is documented. Review DNS load-balancing and DNS-over-HTTPS configuration to identify exposure and prioritize upgrades; configuration assessment is not a substitute for patching.
Patch, then assume compromise.
Upgrade to the applicable fixed release or a later supported release: NetScaler ADC and Gateway 14.1-73.57; NetScaler ADC and Gateway 13.1-64.39; NetScaler ADC 14.1-FIPS 14.1-73.58; or NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.293. Upgrade both nodes in high-availability deployments and affected customer-managed NetScaler instances used in Secure Private Access Hybrid deployments. Follow Citrix bulletin CTX697305 for installation guidance.
No public exploits tracked yet. Mallory keeps watching.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.