Actively exploited in the wild
Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix - NetScaler ADC and NetScaler Gateway · Listed in the CISA KEV since 2026-08-26. This indicates confirmed attacks in production environments.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-8452
CriticalCVSS 9.8KEVExploitation Probability (EPSS)
Elevated risk74th percentile - higher than 74% of all known CVEs
Summary
A memory overflow vulnerability in NetScaler ADC and NetScaler Gateway can lead to unpredictable or erroneous behavior and Denial of Service (DoS) if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
Risk Assessment
An attacker could exploit this vulnerability to cause VPN and proxy service outages, resulting in disruption of remote access for users and potential loss of productivity.
Recommendation
Immediately apply the vendor-supplied patch and review device configurations for gateway and AAA virtual server settings.
Other vulnerabilities in NetScaler ADC and NetScaler Gateway
See all- CVE-2026-88779HighActively exploited
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.
- CVE-2026-19490CriticalActively exploited
Vulnerability in NetScaler ADC and NetScaler Gateway products. Affects ADC versions from 14.1 through 73.32 and from 13.1 through 63.21; Gateway versions from 14.1 through 73.32 and from 13.1 through 63.21.
- CVE-2023-6548MediumActively exploited
A code injection vulnerability in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP, or SNIP management interface to perform authenticated (low privileged) remote code execution on the Management Interface.
- CVE-2026-19489High
Vulnerability in NetScaler ADC and NetScaler Gateway. Affects ADC versions from 14.1 through 73.32 and from 13.1 through 63.21; Gateway from 14.1 through 73.32 and from 13.1 through 63.21.
- CVE-2026-10817High
Insufficient input validation in NetScaler ADC and NetScaler Gateway leads to memory overread if the TCP Timestamp is enabled in the TCP Profile and associated with a virtual server (type LB, CS, VPN) or a configured service.
- CVE-2026-10816High
An unauthenticated attacker can read arbitrary files on NetScaler ADC and NetScaler Gateway if access to NSIP, Cluster Management IP, or SNIP with management access is enabled.
Original NVD description (English source)
Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server
Vulnerability data from NVD (NIST) · CISA KEV · EPSS