What’s Vulnerable › Vulnerabilities
CVE-2026-10817: Insufficient input validation leading to memory overread
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-30 · updated 2026-07-02
- Weakness: CWE-125
Description
Insufficient input validation leading to memory overread in NetScaler ADC and NetScaler Gateway if the TCP TimeStamp is enabled in TCP Profile and is associated with the virtual server (of type LB, CS, VPN) or the service configured on NetScaler
Affected products
- Citrix NetScaler ADC: from 13.1 before 13.1-63.18; from 14.1 before 14.1-72.61 — fixed in 13.1-63.18, 14.1-72.61
- Citrix Netscaler Application Delivery Controller Fips: before 13.1-37.272; 14.1-66.68 (and their updates) — fixed in 13.1-37.272
- Citrix Netscaler Application Delivery Controller Ndcpp: before 13.1-37.272 — fixed in 13.1-37.272
- Citrix NetScaler Gateway: from 13.1 before 13.1-63.18; from 14.1 before 14.1-72.61 — fixed in 13.1-63.18, 14.1-72.61
- NetScaler ADC: from 14.1 before 72.61; from 13.1 before 63.18; from 14.1 FIPS before 72.61; from 13.1 FIPS and NDcPP before 37.272 — fixed in 72.61, 63.18, 37.272
- NetScaler Gateway: from 14.1 before 72.61; from 13.1 before 63.18 — fixed in 72.61, 63.18
How to fix
Upgrade to a fixed version: Citrix NetScaler ADC 13.1-63.18, 14.1-72.61; Citrix Netscaler Application Delivery Controller Fips 13.1-37.272; Citrix Netscaler Application Delivery Controller Ndcpp 13.1-37.272; Citrix NetScaler Gateway 13.1-63.18, 14.1-72.61; NetScaler ADC 72.61, 63.18, 37.272; NetScaler Gateway 72.61, 63.18. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-10817 or the next vulnerability affects your stack