EUVD-2026-87973
GHSA-mh3h-4j34-54mr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network, unauthenticated, no interaction; AC:H because predicting the value requires observing prior values; S:C reflects impact on subsequent/backend systems; integrity and availability high, confidentiality low.
Primary rating from Vendor (NetScaler).
CVSS VectorVendor: NetScaler
Lifecycle Timeline
4DescriptionCVE.org
Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23.
Articles & Coverage 1
AnalysisAI
Predictable value generation in Citrix NetScaler ADC and Gateway (CWE-342) lets unauthenticated remote attackers predict subsequent values from previously observed ones, primarily compromising integrity and availability rather than confidentiality. The vendor rates this 8.8 (CVSS 4.0 AV:N/AC:L/PR:N/UI:N, VC:L/VI:H/VA:H), while our independent assessment sees a 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H) indicating a high attack complexity because exploitation typically requires harvesting at least one prior value. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation targets any internet-reachable Citrix NetScaler ADC or Gateway instance running a version before 14.1-73.37 or 13.1-64.23 (including 14.1-73.37 FIPS and 13.1.37.279 FIPS/NDcPP builds); no authentication or user interaction is required per the vendor CVSS (PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor (NetScaler) CVSS 4.0 vector rates this AV:N/AC:L/PR:N/UI:N with VC:L/VI:H/VA:H and subsequent-system impacts SC:L/SI:L/SA:L (score 8.8), describing a network-reachable, unauthenticated, no-interaction weakness whose dominant impact is integrity and availability rather than confidentiality. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Citrix NetScaler ADC to 14.1-73.37 or 13.1-64.23, and FIPS/NDcPP builds to 14.1-73.37 FIPS or 13.1.37.279 FIPS/NDcPP; upgrade Citrix NetScaler Gateway to 14.1-73.37 or 13.1-64.23. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every NetScaler ADC and Gateway instance, identify which are internet-facing, record exact build levels, and flag ADC below 14.1-73.37 or 13.1-64.23 (including 14.1-73.37 FIPS and 13.1.37.279 FIPS/NDcPP builds) and Gateway below 14.1-73.37 or 13.1-64.23; verify patch status directly with the Citrix advisory, since the advisory text lists fixed releases while our internal tracking still marks patch as unavailable, and until that is resolved restrict management access to a hardened management network, enable logging of value-generation and authentication events, and rate-limit or block anomalous external traffic to NetScaler virtual servers. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Citrix NetScaler ADC and NetScaler Gateway deployments running builds prior to 14.1-73.37 or 13.1-64.23 (including the c
Unauthenticated command execution in Citrix NetScaler ADC (before 14.1-73.37, before 13.1-64.23, and the corresponding F
A remote, unauthenticated attacker can cause a denial-of-service condition on NetScaler ADC and NetScaler Gateway applia
An insufficient input validation vulnerability exists in Citrix NetScaler ADC and NetScaler Gateway when configured as a
The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
The CAB file parser in Dr.Web 5.0.2.03300, Trend Micro HouseCall 9.120.0.1004, Kaspersky Anti-Virus 7.0.0.125, Sophos An
HTTP request smuggling (CWE-444) in Citrix NetScaler ADC and NetScaler Gateway allows unauthenticated, remote attackers
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Emsis
Remote unauthenticated attackers can trigger a memory overflow in Citrix NetScaler ADC and Gateway, leading to unpredict
A memory overflow in Citrix NetScaler ADC and NetScaler Gateway can be triggered by unauthenticated remote attackers (CV
Memory overflow in Citrix NetScaler ADC and NetScaler Gateway running versions prior to 14.1-73.37 or 13.1-64.23 (and th
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today