EUVD-2026-40310
GHSA-jxcr-w9q6-gmhx
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent management-interface access (AV:A), no auth or interaction (PR:N/UI:N), low complexity; arbitrary file read yields C:H with no integrity or availability impact (I:N/A:N).
Primary rating from Vendor (50a63c94-1ea7-4568-8c11-eb79e7c5a2b5).
CVSS VectorVendor: 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5
Lifecycle Timeline
2DescriptionCVE.org
Arbitrary File Read (Unauthenticated) in NetScaler ADC and NetScaler Gateway if the access to NSIP, Cluster Management IP or SNIP with management access is enabled
AnalysisAI
Arbitrary file read in Citrix NetScaler ADC and NetScaler Gateway lets unauthenticated attackers on an adjacent network retrieve sensitive files from the appliance when the NSIP, Cluster Management IP, or a SNIP has management access enabled. The flaw (CWE-73, external control of file name or path) carries a CVSS 4.0 base score of 7.1 with high confidentiality impact, and no public exploit identified at time of analysis. Exposure is gated by the management interface being reachable, which limits but does not eliminate risk given NetScaler's history of attacker targeting.
Technical ContextAI
NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway are network appliances providing application delivery, load balancing, and remote/VPN access; they are administered through management IPs (NSIP for the appliance, Cluster Management IP for clustered deployments, and SNIP/subnet IPs when management access is enabled on them). The root cause is CWE-73, External Control of File Name or Path, meaning attacker-influenced input is used to construct a file path without adequate validation, allowing traversal to or selection of files outside the intended scope. No CPE strings were supplied in the input, so exact build/version enumeration must come from the Citrix advisory (CTX696604); the affected components are the management-plane services listening on the NSIP/Cluster IP/SNIP rather than the data-plane VIPs.
RemediationAI
Apply the fixed builds published by Citrix in advisory CTX696604 (https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604); exact patched version numbers were not present in the supplied data, so confirm them directly from that advisory before scheduling the upgrade. As a primary compensating control until patched, restrict management access by ensuring the NSIP, Cluster Management IP, and any SNIP are not reachable from untrusted or general user networks - place management on a dedicated out-of-band/isolated VLAN and restrict it with firewall ACLs to known administrator hosts, which closes the adjacent-network attack path described here with the trade-off that administrators must reach the appliance via the management segment. Where SNIP management access is not required, disabling management access on the SNIP removes that exposure vector with minimal operational impact, while disabling it on the NSIP/Cluster IP is generally not feasible since core administration depends on it.
Citrix NetScaler ADC and Gateway contain an unauthenticated remote code execution vulnerability exploited massively in s
Sensitive information disclosure in Citrix NetScaler ADC and NetScaler Gateway - widely known as 'Citrix Bleed' - allows
Memory overread in Citrix NetScaler ADC and NetScaler Gateway (versions before 14.1-43.56 and 13.1-58.32) lets remote un
Citrix NetScaler ADC and Gateway contain a memory overflow vulnerability (CVE-2025-6543, CVSS 9.8) leading to unintended
Denial of service and memory corruption in Citrix NetScaler ADC and NetScaler Gateway allows remote unauthenticated atta
Memory overread in Citrix NetScaler ADC and NetScaler Gateway lets remote attackers read out-of-bounds memory when the a
Improper access control vulnerability in NetScaler ADC and NetScaler Gateway management interfaces that allows unauthent
Denial of Service in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CV
Unspecified vulnerability in the Diffie-Hellman key agreement implementation in the management GUI Java applet in Citrix
Unspecified vulnerability in the management GUI in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler
Denial of service in Citrix NetScaler ADC and NetScaler Gateway stems from multiple memory overflow conditions that prod
Denial of service in Citrix NetScaler ADC and NetScaler Gateway allows remote attackers to crash or render unresponsive
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today