CVE-2026-10816

This vulnerability is like leaving a closet door unlocked: without logging in, an attacker who can reach the right “admin entry points” may be able to open and view arbitrary files on the device. Those files can include configuration details and other sensitive information that help attackers plan the next step.

This matters if you run NetScaler ADC or NetScaler Gateway and you have management access enabled on NSIP, Cluster Management IP, or an SNIP that has management access turned on. The risk is specifically tied to reachability: it’s only a concern if an attacker can reach those management interfaces from their side (for example, from the internet or an untrusted network).

This is a GREEN issue: there is no CISA KEV entry and no confirmed, dated public exploitation claim in the provided findings. Still, because it allows unauthenticated reading of arbitrary files, you should update promptly if your management interfaces are reachable as described.

1. Confirm exposure (most important)

   • Identify the configured addresses for: NSIP, Cluster Management IP, and SNIP(s).
   • Verify whether SNIP management access is enabled for any SNIP.
   • Check network controls (firewalls/security groups) to determine whether those management addresses are reachable from untrusted networks (especially the public internet).

2. Confirm your current NetScaler version

   • Record the exact ADC/Gateway version currently deployed.

3. Upgrade to a fixed release

   • NetScaler ADC: fixed in 72.61, 63.18, or 37.272.
   • NetScaler Gateway: fixed in 72.61, 63.18, or 37.272.
   • Choose the fixed version that matches your supported upgrade path.

4. Validate after upgrading

   • Re-check that the management interfaces are still restricted to approved administrator networks.
   • Ensure no unexpected SNIP management access is enabled.

5. If you cannot upgrade immediately

   • Restrict network access so that NSIP / Cluster Management IP / any management-enabled SNIP are not reachable from untrusted networks. The findings indicate the vulnerability depends on “management access is enabled” and practical reachability of those interfaces, so tightening access is the key temporary control.

6. What to monitor

   • Monitor for repeated connection attempts to the management interfaces from unexpected source networks.
   • Review device logs for unusual access patterns around management ports.

CISA due date:

• Not provided (not listed in KEV in the provided findings).

Severity/impact: Arbitrary File Read (CWE-73) in NetScaler ADC and NetScaler Gateway can allow unauthenticated users to read files on the underlying system. The practical risk hinges on reachability to management endpoints.

Mechanism and triggering conditions: The findings state that an unauthenticated attacker can read arbitrary files without user interaction. Preconditions include access to NSIP, Cluster Management IP, or SNIP with management access enabled.

Exploitation status: Not listed in CISA KEV, and the provided news/exploit findings do not show a clear dated real-world exploitation claim or public exploit code.

Patch status: Fixed versions are provided for both ADC and Gateway: 72.61, 63.18, 37.272.

EPSS: A prediction is present in the findings (0.2% with a flat trend), but since KEV is not listed and exploitation is not confirmed in the provided sources, no exploitation certainty is implied.

Exploit maturity: Based on the findings, exploit maturity is not demonstrated by public exploit availability or confirmed press reporting in the provided materials.