CVE Tools
Track your stack

Citrix Patches Six NetScaler Flaws Allowing File Read and Denial-of-Service

The Hacker NewsBy The Hacker News

PatchNetScaler ADCNetScaler Gateway

Our summary

Citrix has released security updates for NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) to remediate six vulnerabilities that could let an attacker perform arbitrary file reads or cause denial-of-service conditions. Affected CVEs include CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, and CVE-2026-13474, impacting scenarios such as SAML parsing, gateway/AAA configurations, load balancing/DNS proxy deployments, and HTTP/2 handling. Fixes are available in specified 13.1 and 14.1 NetScaler releases, with additional configuration guidance required for CVE-2026-13474 via the Http2SmallWndTimeout setting when HTTP Strict Profiles are not used.

Read at The Hacker News

The Hacker News publishes this story on its own site; we link to it rather than reprint it.

  1. SecurityWeekCitrix Patches NetScaler Vulnerabilities, Including New ‘HTTP/2 Bomb’ AttackCVE-2026-10816, CVE-2026-13474 +3
  2. BleepingComputerCISA orders feds to patch Citrix NetScaler RCE flaw by SaturdayCVE-2026-3055, CVE-2026-8452
  3. SecurityWeekRecent Citrix NetScaler Vulnerability Exploited in the WildCVE-2026-8451, CVE-2026-8452
  4. Bishop FoxNo Crash Required: Verifying the Citrix NetScaler SAML Patch for CVE-2026-8452CVE-2026-8451, CVE-2026-8452
  5. watchTowr LabsCitrixBleed To Infinity And Beyond (Citrix NetScaler Pre-Auth Memory Overread CVE-2026-8451)CVE-2026-3055, CVE-2026-8451
  6. The Hacker NewsWarning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active ExploitationCVE-2026-8452
  7. BleepingComputerCritical Citrix NetScaler auth bypass now leveraged in attacksCVE-2026-3055
  8. Help Net SecurityWeek in review: Compromised Zimbra servers, previously patched Citrix NetScaler flaw exploitedCVE-2026-8452
  9. Help Net SecurityPreviously patched Citrix NetScaler flaw exploited in the wild (CVE-2026-8452)CVE-2026-8452
  10. The Hacker NewsCISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server BugsCVE-2026-8452

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store