What’s Vulnerable › Vulnerabilities
CVE-2026-8655: Multiple Memory overflow vulnerabilities leading to unpredictable or erroneous behavior and Denial of Service
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-30 · updated 2026-07-01
- Weakness: CWE-119
Description
Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if NetScaler ADC is configured as an LB of type Oracle OR NetScaler ADC is configured as a DNS Proxy OR NetScaler ADC is configured as a DNS recursive resolver deployment
Summary
Multiple memory overflow vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway can cause unpredictable or erroneous behavior and denial of service. Exploitation requires NetScaler ADC to be configured as an Oracle-type load balancer, a DNS proxy, or a DNS recursive resolver. The flaw is rated CVSS 9.8 critical, but there is no evidence of active exploitation (not in CISA KEV, SSVC exploitation none, EPSS 0.6%). Affected versions are fixed in NetScaler ADC 13.1-37.272, 13.1-63.18, and 14.1-72.61, and NetScaler Gateway 13.1-63.18 and 14.1-72.61; upgrade to these versions, and until then restrict or monitor the affected configurations.
توجد ثغرات متعددة لفيضان الذاكرة في Citrix NetScaler ADC وNetScaler Gateway قد تؤدي إلى سلوك غير متوقع أو خاطئ وإلى حجب الخدمة. ويشترط للاستغلال أن يكون NetScaler ADC مُهيأً كموازن أحمال من نوع Oracle أو كـ DNS Proxy أو كـ DNS recursive resolver. صُنّفت الثغرة بدرجة 9.8 حرجة، لكن لا يوجد دليل على استغلال فعلي (ليست في CISA KEV، وتقييم SSVC للاستغلال none، واحتمال EPSS للاستغلال خلال 30 يوماً 0.6%). تم إصلاح الإصدارات المتأثرة في NetScaler ADC 13.1-37.272 و13.1-63.18 و14.1-72.61، وفي NetScaler Gateway 13.1-63.18 و14.1-72.61؛ يُنصح بالترقية إلى هذه الإصدارات، وإلى حين ذلك بتقييد الإعدادات المتأثرة أو مراقبتها.
Affected products
- Citrix NetScaler ADC: from 13.1 before 13.1-63.18; from 14.1 before 14.1-72.61 — fixed in 13.1-63.18, 14.1-72.61
- Citrix Netscaler Application Delivery Controller Fips: before 13.1-37.272; 14.1-66.68 (and their updates) — fixed in 13.1-37.272
- Citrix Netscaler Application Delivery Controller Ndcpp: before 13.1-37.272 — fixed in 13.1-37.272
- Citrix NetScaler Gateway: from 13.1 before 13.1-63.18; from 14.1 before 14.1-72.61 — fixed in 13.1-63.18, 14.1-72.61
- NetScaler ADC: from 14.1 before 72.61; from 13.1 before 63.18; from 14.1 FIPS before 72.61; from 13.1 FIPS and NDcPP before 37.272 — fixed in 72.61, 63.18, 37.272
- NetScaler Gateway: from 14.1 before 72.61; from 13.1 before 63.18 — fixed in 72.61, 63.18
How to fix
Upgrade to a fixed version: Citrix NetScaler ADC 13.1-63.18, 14.1-72.61; Citrix Netscaler Application Delivery Controller Fips 13.1-37.272; Citrix Netscaler Application Delivery Controller Ndcpp 13.1-37.272; Citrix NetScaler Gateway 13.1-63.18, 14.1-72.61; NetScaler ADC 72.61, 63.18, 37.272; NetScaler Gateway 72.61, 63.18. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-8655 or the next vulnerability affects your stack