NetScaler ADC CVE-2026-10816

Exploitation requires that management access be enabled and reachable on the NSIP, Cluster Management IP, or a SNIP, and that the attacker have adjacent-network access to that management interface (CVSS AV:A, not full Internet-wide network reach). No authentication is required (PR:N) and no user interaction is needed (UI:N). The key limiting factors are: the management interface must be exposed to the attacker's network segment, and SNIP-based exposure only applies when management access has been explicitly enabled on that SNIP - appliances whose management plane is isolated on a dedicated out-of-band network are not reachable by an arbitrary adjacent attacker.

The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N) describes an adjacent-network, low-complexity, unauthenticated attack with high confidentiality impact and no special attack requirements, scoring 7.1 (High). The AV:A (adjacent) value - rather than AV:N (network) - together with the description's precondition that management access be enabled on the NSIP/Cluster IP/SNIP, indicates real-world exposure depends heavily on management-plane network segmentation: properly isolated management interfaces sharply reduce the attack surface. No EPSS score, KEV listing, or POC was provided, so there is no public evidence of active exploitation or available exploit code at this time. Note a minor inconsistency: the vendor vector assigns VI:L (low integrity impact) even though the described primary impact is arbitrary file read, which is normally a pure confidentiality issue - this should be verified against the vendor advisory. Given Citrix NetScaler's strong track record as a high-value exploitation target, this should be treated as a credible priority where management interfaces are exposed, but as lower urgency where management access is restricted to a trusted out-of-band network.

An attacker positioned on the same network segment as an exposed NetScaler management interface (NSIP, Cluster Management IP, or a management-enabled SNIP) sends a crafted request that manipulates a file path parameter to read sensitive files - such as configuration data or credentials - from the appliance without authenticating. Because the attack is low-complexity and requires no user interaction, a single adjacent host (e.g., a compromised device on a poorly segmented management LAN) is sufficient; no public exploit code has been identified at time of analysis.