Loading vulnerability…
Multiple Memory Overflows in Citrix NetScaler ADC and Gateway
CVE-2026-107412 comprises multiple memory overflow vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances configured as a Gateway using SSL VPN, ICA Proxy, CVPN, or RDP Proxy, or as an AAA virtual server. Unauthenticated network attackers can trigger unpredictable or erroneous appliance behavior and denial of service without user interaction. The vulnerability is rated critical with a CVSS v4.0 score of 9.5. Specific vulnerable functions and triggering inputs have not been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can cause abnormal appliance behavior or denial of service, potentially disrupting remote access, authentication, and application access through affected Gateway or AAA services. Although the CVSS vector assigns high confidentiality, integrity, and availability impacts to vulnerable and subsequent systems, remote code execution, data disclosure, and other specific compromise outcomes have not been established.
If you can’t patch tonight, do this now.
No vendor-provided interim workaround is available. Review appliance configurations to identify Gateway and AAA virtual-server exposure, and prioritize internet-facing affected appliances for immediate upgrades. Configuration assessment is not a substitute for patching.
Patch, then assume compromise.
Upgrade NetScaler ADC and NetScaler Gateway 14.1 to 14.1-73.57 or later, or 13.1 to 13.1-64.39 or later within the applicable branch. Upgrade NetScaler ADC 14.1-FIPS to 14.1-73.58 FIPS or later, and NetScaler ADC 13.1-FIPS or 13.1-NDcPP to 13.1-37.293 or later within the respective branch. Update both nodes of high-availability pairs and affected customer-managed NetScaler instances in Secure Private Access Hybrid deployments. Unsupported 12.1 and 13.0 deployments should migrate to a supported release. Appliance upgrades terminate existing ICA sessions, requiring users to reconnect.
No public exploits tracked yet. Mallory keeps watching.
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.