Which versions of NetScaler ADC are affected by CVE-2026-8655?

Citrix NetScaler ADC and NetScaler Gateway deployments face denial-of-service risk from a remote, unauthenticated memory overflow vulnerability (CVE-2026-8655, CVSS 8.8), with no public exploit…. A patch is available.

How to fix or mitigate CVE-2026-8655?

Within 24 hours: Identify all Citrix NetScaler ADC and Gateway appliances in your environment and assess which are configured for DNS or load-balancing roles. Within 7 days: Implement network segmentation to restrict access to affected appliances and deploy rate-limiting or DoS protection rules on upstream network infrastructure. Within 30 days: Monitor Citrix security advisories for patch availability; develop and validate a deployment plan for emergency patching upon release.

NetScaler ADC CVE-2026-8655

Q: What is the CVSS score of CVE-2026-8655?

CVE-2026-8655 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-40308 HIGH

Buffer Overflow (CWE-119)

2026-06-30 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5

GHSA-rw96-6cvj-x57v

Citrix Oracle Denial Of Service Buffer Overflow Netscaler Application Delivery Controller Netscaler Gateway

8.8

CVSS 4.0 · Vendor: 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5

Severity by source

Vendor (50a63c94-1ea7-4568-8c11-eb79e7c5a2b5) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

ENISA EUVD

HIGH

qualitative

vuln.today AI

8.6 HIGH

Network-reachable, low-complexity, unauthenticated handler flaw with no user interaction; impact is predominantly availability (DoS) with only minor confidentiality and integrity effects.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:L

Primary rating from Vendor (50a63c94-1ea7-4568-8c11-eb79e7c5a2b5).

CVSS VectorVendor: 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 30, 2026 - 15:01 EUVD

Analysis Generated

Jun 30, 2026 - 13:34 vuln.today

CVE Published

Jun 30, 2026 - 13:19 cve.org

HIGH 8.8

DescriptionCVE.org

Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if NetScaler ADC is configured as an LB of type Oracle OR NetScaler ADC is configured as a DNS Proxy OR NetScaler ADC is configured as a DNS recursive resolver deployment

AnalysisAI

Denial of service in Citrix NetScaler ADC and NetScaler Gateway stems from multiple memory overflow conditions that produce unpredictable or erroneous behavior when the appliance is configured for specific DNS or load-balancing roles. Remote unauthenticated attackers can send crafted traffic to a vulnerable appliance to crash or destabilize it, with the CVSS 4.0 score of 8.8 driven primarily by high availability impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The affected technology is the Citrix NetScaler ADC (Application Delivery Controller) and NetScaler Gateway, network appliances that perform load balancing, SSL offload, and remote access for enterprise applications. The flaw is a memory overflow class (no CWE was assigned in the source data, but the description and 'Memory overflow' wording point to a buffer/memory-handling defect) triggered within specific service handlers: the Oracle load-balancing virtual server type, the DNS Proxy function, and the DNS recursive resolver deployment. These code paths parse externally supplied protocol data (Oracle TNS traffic or DNS queries), and malformed input drives the appliance into an out-of-bounds or erroneous memory state, causing instability rather than confirmed code execution.

RemediationAI

Apply the patched NetScaler ADC/Gateway firmware identified in Citrix advisory CTX696604 (https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604); an exact fixed version was not present in the provided data and must be taken from that advisory. Where immediate patching is not possible, reduce exposure by disabling or removing the specific triggering features that are not in use - remove or reconfigure Oracle-type load-balancing virtual servers, and disable the DNS Proxy and DNS recursive resolver functions if they are not required, accepting that doing so breaks Oracle database load balancing and DNS resolution services that depend on them. Additionally, restrict network reachability to the DNS and Oracle LB listeners using upstream firewall/ACL rules so only trusted clients can reach those ports, noting this limits legitimate clients as well. No vendor-released patch version was independently confirmed from the provided data beyond the advisory reference.