EUVD-2026-87958
GHSA-mx58-p288-86qp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network unauthenticated command execution (AV:N/PR:N) with appliance-to-network scope change (S:C) and full C/I/A; AC:H reflects the CVSS 4.0 AT:P attack requirement.
Primary rating from Vendor (NetScaler).
CVSS VectorVendor: NetScaler
Lifecycle Timeline
8DescriptionCVE.org
Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.
Articles & Coverage 3
AnalysisAI
Unauthenticated command execution in Citrix NetScaler ADC (before 14.1-73.37, before 13.1-64.23, and the corresponding FIPS and NDcPP builds) and NetScaler Gateway (before 14.1-73.37 and before 13.1-64.23) lets a network-reachable attacker with no credentials and no user interaction run arbitrary commands on the appliance. Both our assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) and the vendor's CVSS 4.0 score of 9.5 agree on high confidentiality, integrity, and availability impact, with the CVSS 4.0 AT:P flag indicating that a specific attack precondition must hold before the flawed input-validation path is reachable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation targets NetScaler ADC or NetScaler Gateway running versions before 14.1-73.37, 13.1-64.23, the 14.1-73.37 FIPS build, or 13.1.37.279 FIPS/NDcPP, reachable over the network with no authentication or user interaction required (PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority vulnerability, not a high-CVSS-but-low-real-risk case. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade NetScaler ADC to 14.1-73.37 or 13.1-64.23 (with 14.1-73.37 FIPS and 13.1.37.279 FIPS/NDcPP as the equivalent fixed builds for those variant trains) and NetScaler Gateway to 14.1-73.37 or 13.1-64.23; see the vendor advisory at https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every NetScaler ADC and NetScaler Gateway instance, identify any running versions earlier than 14.1-73.37 or 13.1-64.23 (including the corresponding FIPS and NDcPP builds), and immediately restrict internet exposure of management and VPN virtual servers to known trusted source ranges via appliance ACLs or upstream firewall rules, disabling any unused management or VPN listeners; preserve current configurations and logs as a baseline. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Citrix NetScaler ADC and NetScaler Gateway deployments running builds prior to 14.1-73.37 or 13.1-64.23 (including the c
A remote, unauthenticated attacker can cause a denial-of-service condition on NetScaler ADC and NetScaler Gateway applia
An insufficient input validation vulnerability exists in Citrix NetScaler ADC and NetScaler Gateway when configured as a
The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
The CAB file parser in Dr.Web 5.0.2.03300, Trend Micro HouseCall 9.120.0.1004, Kaspersky Anti-Virus 7.0.0.125, Sophos An
HTTP request smuggling (CWE-444) in Citrix NetScaler ADC and NetScaler Gateway allows unauthenticated, remote attackers
Predictable value generation in Citrix NetScaler ADC and Gateway (CWE-342) lets unauthenticated remote attackers predict
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Emsis
Remote unauthenticated attackers can trigger a memory overflow in Citrix NetScaler ADC and Gateway, leading to unpredict
A memory overflow in Citrix NetScaler ADC and NetScaler Gateway can be triggered by unauthenticated remote attackers (CV
Memory overflow in Citrix NetScaler ADC and NetScaler Gateway running versions prior to 14.1-73.37 or 13.1-64.23 (and th
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today