NetScaler ADC CVE-2026-8655

Exploitation requires the NetScaler ADC to be configured in at least one of three specific modes: a load-balancing virtual server of type Oracle, a DNS Proxy, or a DNS recursive resolver deployment. If none of these configurations are present, the appliance is not exposed to this flaw regardless of the high CVSS score - this is the key limiting factor. When one of those modes is active, the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and low complexity are needed, so any network attacker able to reach the affected listener can attempt it.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a network-reachable, low-complexity, unauthenticated attack requiring no user interaction, which is a strong real-world risk profile for an internet-facing appliance. However, the impact metrics are weighted toward availability (VA:H) with only low confidentiality and integrity impact (VC:L/VI:L) and low subsequent-system availability (SA:L), so the realistic outcome is denial of service, not full compromise. No EPSS score was provided, the CVE is not in CISA KEV, and no POC is referenced - meaning the headline 8.8 reflects exposure and ease, not confirmed widespread exploitation. The most important caveat is conditionality: exploitation is gated on the appliance running an Oracle LB vserver, DNS Proxy, or DNS recursive resolver, so appliances without those configurations are likely not affected despite the high base score.

An attacker who can reach a NetScaler appliance that is acting as a DNS recursive resolver or DNS proxy sends a stream of malformed DNS queries that trigger the memory overflow, causing the appliance to behave erratically or crash and dropping the services behind it. Because the attack is network-based, unauthenticated, and low-complexity, it can be repeated to sustain an outage; no public POC is currently identified.