EUVD-2026-40317
GHSA-jmh3-rwcx-284r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because exploitation requires TCP TimeStamp explicitly enabled and bound to a virtual server - a non-default configuration beyond the attacker's control; confidentiality impact only.
Primary rating from Vendor (50a63c94-1ea7-4568-8c11-eb79e7c5a2b5).
CVSS VectorVendor: 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5
Lifecycle Timeline
2DescriptionCVE.org
Insufficient input validation leading to memory overread in NetScaler ADC and NetScaler Gateway if the TCP TimeStamp is enabled in TCP Profile and is associated with the virtual server (of type LB, CS, VPN) or the service configured on NetScaler
AnalysisAI
Memory overread in Citrix NetScaler ADC and NetScaler Gateway exposes low-confidence partial memory contents to unauthenticated remote attackers when TCP TimeStamp processing is triggered against a misconfigured or specifically configured TCP Profile. The vulnerability is rooted in insufficient input validation (CWE-125) within the TCP TimeStamp handling code path, affecting virtual servers of type Load Balancer, Content Switching, and VPN, as well as configured services. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis, though the network-accessible, zero-privilege attack vector warrants prompt patching given NetScaler's broad enterprise deployment.
Technical ContextAI
NetScaler ADC and NetScaler Gateway are Citrix application delivery controller and VPN gateway products, widely deployed as network ingress points. The vulnerability resides in the TCP TimeStamp feature (RFC 1323 TCP extensions), which adds 32-bit timestamp values to TCP segments for RTT measurement and PAWS (Protection Against Wrapped Sequence numbers). When this feature is enabled in a TCP Profile and that profile is bound to a virtual server (LB, CS, or VPN type) or a service object on the NetScaler, the appliance's input validation logic fails to adequately bounds-check incoming timestamp data. CWE-125 (Out-of-bounds Read) describes a scenario where a program reads data beyond the allocated buffer boundary, potentially exposing adjacent memory regions. The CVE tags also reference 'Buffer Overflow', but the CWE-125 classification and 'memory overread' description specifically indicate a read-side out-of-bounds condition rather than a write-side overflow - a meaningful distinction for exploitation potential and impact. The memory overread results in information disclosure (VC:L in CVSS 4.0), not code execution or availability impact. The Citrix advisory is tracked under CTX696604.
RemediationAI
The primary remediation is to apply the patch released by Citrix as documented in advisory CTX696604 (https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604); the exact fixed version number is not confirmed in the available intelligence data and must be obtained directly from the Citrix advisory. As a compensating control pending patching, administrators can disable TCP TimeStamp in the TCP Profile(s) bound to internet-facing virtual servers (LB, CS, VPN) and services - this directly removes the vulnerable code path. The trade-off is loss of TCP RTT measurement accuracy and PAWS functionality, which may slightly reduce performance optimization on high-latency links but carries no security downside. To identify exposure scope, administrators should audit all TCP Profiles on the appliance via 'show tcpProfile' and check which have 'TCP Timestamp' enabled, then cross-reference with bound virtual servers using 'show lb vserver' / 'show cs vserver' / 'show vpn vserver'. Patch version confirmed only by vendor advisory; no independent third-party confirmation available at time of analysis.
Citrix NetScaler ADC and Gateway contain an unauthenticated remote code execution vulnerability exploited massively in s
Sensitive information disclosure in Citrix NetScaler ADC and NetScaler Gateway - widely known as 'Citrix Bleed' - allows
Memory overread in Citrix NetScaler ADC and NetScaler Gateway (versions before 14.1-43.56 and 13.1-58.32) lets remote un
Citrix NetScaler ADC and Gateway contain a memory overflow vulnerability (CVE-2025-6543, CVSS 9.8) leading to unintended
Denial of service and memory corruption in Citrix NetScaler ADC and NetScaler Gateway allows remote unauthenticated atta
Memory overread in Citrix NetScaler ADC and NetScaler Gateway lets remote attackers read out-of-bounds memory when the a
Improper access control vulnerability in NetScaler ADC and NetScaler Gateway management interfaces that allows unauthent
Denial of Service in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CV
Unspecified vulnerability in the Diffie-Hellman key agreement implementation in the management GUI Java applet in Citrix
Unspecified vulnerability in the management GUI in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler
Denial of service in Citrix NetScaler ADC and NetScaler Gateway stems from multiple memory overflow conditions that prod
Denial of service in Citrix NetScaler ADC and NetScaler Gateway allows remote attackers to crash or render unresponsive
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today