CVE Tools
Track your stack

Citrix Patches NetScaler Vulnerabilities, Including New ‘HTTP/2 Bomb’ Attack

SecurityWeekBy Ionut Arghire

PatchNetScaler ADCNetScaler Gateway

Our summary

Citrix has released new security updates for NetScaler ADC and NetScaler Gateway that address six vulnerabilities, including the recently publicized HTTP/2 Bomb denial-of-service flaw. Affected CVEs include CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816 (memory corruption and arbitrary file read issues), plus CVE-2026-49975 (an out-of-bounds read) and CVE-2026-13474 for the NetScaler-specific HTTP/2 Bomb behavior that can knock Apache HTTP Server offline. These issues matter because exploitation could enable service disruption and, for some bugs, memory-related data exposure; upgrade to the fixed NetScaler versions as indicated by Citrix and verify whether your configuration enables the vulnerable components.

Read at SecurityWeek

SecurityWeek publishes this story on its own site; we link to it rather than reprint it.

  1. The Hacker NewsCitrix Patches Six NetScaler Flaws Allowing File Read and Denial-of-ServiceCVE-2026-10816, CVE-2026-13474 +3
  2. SecurityWeekRecent Citrix NetScaler Vulnerability Exploited in the WildCVE-2026-8451, CVE-2026-8452
  3. Bishop FoxNo Crash Required: Verifying the Citrix NetScaler SAML Patch for CVE-2026-8452CVE-2026-8451, CVE-2026-8452
  4. The Hacker NewsWarning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active ExploitationCVE-2026-8452
  5. Help Net SecurityWeek in review: Compromised Zimbra servers, previously patched Citrix NetScaler flaw exploitedCVE-2026-8452
  6. Help Net SecurityPreviously patched Citrix NetScaler flaw exploited in the wild (CVE-2026-8452)CVE-2026-8452
  7. BleepingComputerCISA orders feds to patch Citrix NetScaler RCE flaw by SaturdayCVE-2026-8452
  8. The Hacker NewsCISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server BugsCVE-2026-8452
  9. The Hacker NewsCritical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA ServersCVE-2026-8451
  10. The Hacker News⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and MoreCVE-2026-8452

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store