NetScaler ADC EUVD-2026-40320

Exploitation requires that HTTP/2 is explicitly enabled in an HTTP Profile AND that this profile is associated with a virtual server of type LB, CS, or VPN, or with a configured service on the NetScaler appliance - this is the exact configuration prerequisite stated in the description and is not the default for all deployments. Where these conditions are met, the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and low complexity are needed beyond network reachability to the affected endpoint. The primary limiting factor is therefore configuration: appliances whose vservers/services do not have HTTP/2 enabled and bound are not exploitable, which substantially narrows real-world exposure relative to the raw 8.7 score.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a low-complexity, network-reachable, unauthenticated attack with high impact to the vulnerable system's availability (VA:H) and a minor subsequent-system availability effect (SA:L), yielding a high score of 8.7. However, no EPSS probability, KEV listing, or POC indicator was provided, so the real-world likelihood signal is currently weak: this is a high-severity-by-vector issue without confirmed exploitation evidence. The practical risk is meaningfully gated by configuration - HTTP/2 must be enabled and bound to a virtual server/service - so environments using only HTTP/1.x on their vservers are not exposed. Because NetScaler appliances are frequently internet-facing and historically targeted, a DoS against an enabled HTTP/2 vserver could be operationally severe even though it does not compromise data; absent EPSS/KEV data, treat this as a configuration-dependent availability risk rather than a confirmed mass-exploitation threat.

An attacker who can reach an internet-facing NetScaler LB, CS, or VPN virtual server that has HTTP/2 enabled sends a stream of malformed HTTP/2 requests that trigger a memory leak in the appliance's HTTP/2 handling. Repeated requests gradually exhaust memory until the appliance stops processing legitimate traffic, denying service to all users behind that vserver. No public exploit code has been identified, and given AV:N/AC:L/PR:N the attack requires only network reachability to the HTTP/2-enabled endpoint.