EUVD-2026-40307
GHSA-r7wg-r5wj-c765
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach internet-facing Gateway/AAA virtual server
-
DeliverySend crafted request to vulnerable handler
-
ExploitTrigger memory overflow in appliance
-
ExecutionCause crash and erroneous behavior
-
ImpactDeny remote-access service and expose memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the NetScaler appliance be configured as a Gateway virtual server - specifically in SSL VPN, ICA Proxy, CVPN (Clientless VPN), or RDP Proxy mode - or as an AAA virtual server; appliances not running any of these roles are not exploitable. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication, no user interaction, and no special attack requirements are needed once that configuration is present, and the affected virtual server must be network-reachable by the attacker. The limiting factor is therefore deployment role rather than privilege: the bug is reachable pre-authentication but only on appliances serving Gateway/AAA functions, which is the common production posture for these devices. |
| Impact | Signals are partially conflicting and should be weighed carefully. The CVSS 4.0 base metrics (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:L/VA:H) describe a serious, remotely exploitable, unauthenticated issue with both data-exposure and availability consequences, scoring 8.8 (High). However, exploitation is gated by a real configuration prerequisite - the appliance must be acting as a Gateway or AAA virtual server - which most production NetScaler deployments do satisfy, so the gate is weak in practice. No EPSS score, no SSVC decision, and no CWE were provided, and there is no KEV listing or POC evidence, so the exploitation-likelihood dimension is unmeasured rather than confirmed-low. Given Citrix NetScaler's history as a high-value, mass-targeted edge device, this should be treated as a genuine patching priority despite the absence of EPSS/POC data; the missing CWE and CPE detail are gaps that should be filled from the vendor advisory before final triage. |
| Exploit ScenarioDerived | An attacker reachable over the network sends a crafted request to the internet-facing NetScaler Gateway or AAA virtual server, triggering the memory overflow without authentication. This causes the appliance to behave unpredictably or crash, denying remote-access service to legitimate VPN/ICA users, and given the high confidentiality impact may expose adjacent memory contents. No public proof-of-concept is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 30, 2026
Denial of service and memory corruption in Citrix NetScaler ADC and NetScaler Gateway allows remote unauthenticated attackers to trigger unpredictable or erroneous appliance behavior when the device is deployed as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, low-complexity exploitation with no authentication, and the high confidentiality impact suggests memory contents may be exposed alongside the DoS condition. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV.
RemediationAI
Apply the fixed NetScaler ADC and NetScaler Gateway builds published by Citrix in advisory CTX696604 (https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604); exact fixed build numbers were not in the provided data, so consult that advisory for the precise patched versions for your release train. No vendor-released fix version was supplied here, so treat the advisory as authoritative for version numbers - do not rely on inferred values. As a compensating control where immediate patching is not possible, restrict network reachability of the Gateway/AAA virtual servers (for example, place the management and VPN endpoints behind IP allow-lists or a VPN concentrator, or temporarily unbind unused Gateway features such as RDP Proxy or CVPN); the trade-off is reduced remote-access functionality for users relying on those services. Avoid exposing the affected virtual servers directly to the open internet until patched.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NetScaler ADC and NetScaler Gateway are Citrix's application delivery controller and remote-access gateway appliances, terminating SSL VPN, ICA Proxy, Clientless VPN (CVPN), RDP Proxy, and AAA authentication sessions at the network edge. The flaw is a memory overflow (a buffer/heap memory-safety defect; CWE not assigned in the source data) in the request-handling paths exposed by these Gateway and AAA front-ends. NetScaler edge appliances have historically been affected by memory-handling bugs in these same TCP/HTTP/SSL-VPN code paths (the CitrixBleed family), where over-read or overflow conditions both crash the service and can leak adjacent process memory - consistent with the high confidentiality and availability impacts recorded here. No CPE strings were supplied, so exact affected build numbers must be confirmed from the Citrix advisory.
Know when Netscaler Gateway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L
Remotely reachable, low-complexity, unauthenticated memory overflow on Gateway/AAA virtual servers; high availability (DoS) and confidentiality (memory exposure) impact with limited integrity effect.
Primary rating from Vendor (50a63c94-1ea7-4568-8c11-eb79e7c5a2b5).
CVSS VectorVendor: 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5
Lifecycle Timeline
3DescriptionCVE.org
Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server
Articles & Coverage 1
Executive ViewAI
Citrix NetScaler ADC and Gateway devices used for SSL VPN, ICA Proxy, and RDP gateway services face a critical remote denial-of-service and memory corruption vulnerability exploitable by unauthenticated attackers. Organizations depending on these devices for secure remote access face immediate risk of service disruption and potential exposure of session or credential data from affected systems.
Network segmentation restricting access to affected gateway devices; rate limiting and DDoS protection on exposed management and proxy interfaces; enhanced logging and alerting for memory errors and authentication anomalies; implement or update IPS rules to detect CVE-2026-8452 exploitation patterns; prepare failover procedures to secondary gateway appliances if available; document temporary disable procedures for affected proxy services as contingency.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Netscaler Gateway
View allCitrix NetScaler ADC and Gateway contain an unauthenticated remote code execution vulnerability exploited massively in s
Sensitive information disclosure in Citrix NetScaler ADC and NetScaler Gateway - widely known as 'Citrix Bleed' - allows
Memory overread in Citrix NetScaler ADC and NetScaler Gateway (versions before 14.1-43.56 and 13.1-58.32) lets remote un
Unauthenticated information disclosure in Citrix NetScaler ADC and NetScaler Gateway (versions 14.1 before 73.32 and 13.
Citrix NetScaler ADC and Gateway contain a memory overflow vulnerability (CVE-2025-6543, CVSS 9.8) leading to unintended
Memory overread in Citrix NetScaler ADC and NetScaler Gateway lets remote attackers read out-of-bounds memory when the a
Improper access control vulnerability in NetScaler ADC and NetScaler Gateway management interfaces that allows unauthent
Denial of Service in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CV
Denial of service in Citrix NetScaler ADC and NetScaler Gateway stems from multiple memory overflow conditions that prod
Denial of service in Citrix NetScaler ADC and NetScaler Gateway allows remote attackers to crash or render unresponsive
Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix AD
Memory safety vulnerability leading to memory corruption and Denial of Service in NetScaler ADC and Gateway if the appli
Exploit-DB