NetScaler ADC EUVD-2026-40317

Exploitation requires two explicit conditions to be simultaneously true on the target NetScaler: (1) TCP TimeStamp must be enabled within a TCP Profile object - this is an explicit configuration choice, not a default - and (2) that TCP Profile must be bound to a virtual server of type Load Balancer, Content Switching, or VPN, OR to a service configured on the NetScaler. If neither condition is met (e.g., TCP TimeStamp is disabled in all profiles, or enabled profiles are not bound to any virtual server or service), the vulnerable code path is not reachable. Exploitation is otherwise unconstrained: it requires no authentication (PR:N), no user interaction (UI:N), and is reachable over the network (AV:N). The primary limiting factor for defenders is the configuration prerequisite - organizations that have not explicitly enabled TCP TimeStamp in their TCP Profiles are not exposed.

The vendor-assigned CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N reflects a network-accessible, unauthenticated attack with low confidentiality impact and no integrity or availability consequences. The AT:N designation implies the vendor considers the TCP TimeStamp configuration common enough to treat as a baseline condition rather than a hardening-specific prerequisite - however, TCP TimeStamp enabling in a TCP Profile is an explicit administrative action on NetScaler, not an out-of-the-box default, which may overstate real-world exposure for hardened deployments. No EPSS score was provided in the available intelligence. The CVE is not in the CISA KEV catalog and no public exploit or proof-of-concept code is identified, making widespread opportunistic exploitation unlikely at this time. The primary real-world concern is partial memory disclosure - in high-value NetScaler deployments handling TLS termination or VPN authentication, even a low-volume memory leak could theoretically expose session tokens, credentials, or keying material traversing the appliance's memory space, which elevates practical sensitivity beyond what the CVSS impact score alone conveys. Overall this is a moderate-priority patching item: genuine risk for organizations where the TCP TimeStamp profile is configured and NetScaler is internet-exposed, but not an emergency for environments without that profile binding.

An unauthenticated remote attacker sends a crafted TCP segment containing a malformed or boundary-violating TCP TimeStamp option to an internet-exposed NetScaler virtual server (LB, CS, or VPN type) that has a TCP Profile with TimeStamp enabled. The insufficient input validation triggers an out-of-bounds read in the NetScaler TCP processing stack, causing the appliance to return memory contents adjacent to the intended buffer - potentially leaking fragments of in-memory data such as session state, connection metadata, or other process memory. No public proof-of-concept exploit code is known, but the attack requires no authentication and no user interaction, lowering the bar for exploitation once a working PoC is developed.