Which versions of NetScaler ADC are affected by CVE-2026-13474?

CVE-2026-13474 is a denial-of-service vulnerability in Citrix NetScaler ADC and NetScaler Gateway that enables remote attackers to crash or render these critical devices unresponsive via malformed…. A patch is available.

How to fix or mitigate CVE-2026-13474?

Within 24 hours: Inventory all Citrix NetScaler ADC and Gateway instances and identify which have HTTP/2 enabled on LB, CS, or VPN virtual servers. Within 7 days: Disable HTTP/2 on affected virtual servers where operationally feasible, or implement network access controls and connection rate limiting to restrict inbound traffic. Within 30 days: Monitor Citrix security advisories for patch release and prepare deployment testing procedures.

NetScaler ADC CVE-2026-13474

Q: What is the CVSS score of CVE-2026-13474?

CVE-2026-13474 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-40320 HIGH

Memory Leak (CWE-401)

2026-06-30 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5

GHSA-256v-mmj4-qqjc

Citrix Denial Of Service Netscaler Application Delivery Controller Netscaler Gateway

8.7

CVSS 4.0 · Vendor: 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5

Severity by source

Vendor (50a63c94-1ea7-4568-8c11-eb79e7c5a2b5) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

ENISA EUVD

HIGH

qualitative

vuln.today AI

7.5 HIGH

Network-reachable, unauthenticated, low-complexity DoS with availability-only impact; the HTTP/2 config requirement is a deployment prerequisite, not an access privilege, so PR:N and AC:L hold.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

Primary rating from Vendor (50a63c94-1ea7-4568-8c11-eb79e7c5a2b5).

CVSS VectorVendor: 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 30, 2026 - 15:01 EUVD

Analysis Generated

Jun 30, 2026 - 13:30 vuln.today

CVE Published

Jun 30, 2026 - 13:17 cve.org

HIGH 8.7

DescriptionCVE.org

Denial of service via malformed HTTP/2 requests in NetScaler ADC and NetScaler Gateway if HTTP/2 is enabled in HTTP Profile and associated with the virtual server (of type LB, CS, VPN) or the service configured on NetScaler

AnalysisAI

Denial of service in Citrix NetScaler ADC and NetScaler Gateway allows remote attackers to crash or render unresponsive the appliance by sending malformed HTTP/2 requests, but only when HTTP/2 is enabled in the HTTP Profile and bound to an LB, CS, or VPN virtual server or service. The CVSS 4.0 score of 8.7 reflects high availability impact with no confidentiality or integrity loss, exploitable over the network without authentication or user interaction. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The affected technology is the HTTP/2 protocol handling within NetScaler ADC/Gateway, a widely deployed application delivery controller and remote-access gateway that terminates and proxies client traffic. The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime), indicating that processing certain malformed HTTP/2 frames or streams leaks memory that is never reclaimed; sustained exploitation exhausts available memory and degrades or halts traffic processing. HTTP/2's stream multiplexing and header/frame state machine are common sources of such resource-management defects, and the flaw is only reachable when the HTTP/2 feature is explicitly turned on in an HTTP Profile and associated with a front-end vserver (LB/CS/VPN) or service. No CPE strings were provided in the input, so exact build identifiers cannot be enumerated from this data alone.

RemediationAI

Apply the fixed NetScaler ADC/NetScaler Gateway build identified in the Citrix advisory CTX696604 (https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604); exact fixed version numbers are not present in the provided input and must be taken from that advisory rather than assumed. As a compensating control where patching cannot be immediate, disable HTTP/2 in the HTTP Profile bound to affected LB/CS/VPN virtual servers and services, which removes the attack surface entirely at the cost of falling back to HTTP/1.x (losing HTTP/2 multiplexing performance benefits for clients). Alternatively, restrict or rate-limit untrusted access to the affected HTTP/2-enabled vservers and place them behind upstream filtering, accepting that this only reduces rather than eliminates exposure.