CVE-2026-13474

HTTP/2 is a faster way web traffic can talk to your server. This issue is like someone sending a “broken” HTTP/2 message that causes your NetScaler to get overwhelmed or stop handling traffic, leading to downtime—similar to a traffic controller getting jammed by confusing signals.

This matters if you run NetScaler ADC or NetScaler Gateway for your business, especially if it fronts your website, apps, or VPN. It’s only a risk when HTTP/2 is enabled and tied to the specific load-balancing/content-switching/VPN virtual server or service where traffic is handled. If your device isn’t configured with HTTP/2 on (or isn’t serving that traffic), this specific risk is reduced.

This is GREEN: no CISA KEV listing and no confirmed exploitation reports in the provided materials. Even so, denial-of-service issues can cause immediate disruption if the condition is reachable, so you should patch on your normal maintenance schedule and prioritize if your NetScaler is internet-facing.

1. Identify the affected role

   • Determine whether your environment uses NetScaler ADC, NetScaler Gateway, or both.

2. Confirm the HTTP/2 exposure condition

   • On the NetScaler, find the HTTP Profile(s) used by your traffic.
   • Check whether HTTP/2 is enabled in the HTTP Profile.
   • Confirm that the HTTP Profile is associated with an active virtual server/service of type LB (load balancing), CS (content switching), or VPN (and the service configured on the NetScaler).

3. Check current version(s)

   • Record the exact NetScaler software version on each affected ADC and/or Gateway.

4. Upgrade to a fixed version

   • NetScaler ADC is fixed in: 72.61, 63.18, 37.272.
   • NetScaler Gateway is fixed in: 72.61, 63.18, 37.272.
   • Upgrade to the highest fixed version available that matches your platform/support window.
   • Validate after upgrade that normal web/app/VPN traffic still works, including HTTP/2-capable clients.

5. Temporary workaround if patching is delayed

   • Disable HTTP/2 in the HTTP Profile(s) used by the LB/CS/VPN virtual server or service that handles incoming traffic.
   • Re-test application connectivity from representative clients.
   • Keep the change until you complete the fixed upgrade.

6. What to monitor

   • After changes, watch for signs of instability around web/App/VPN request handling (for example, unexpected drops in successful requests or error spikes), and ensure service uptime returns to baseline.

Severity/impact: This is a denial-of-service issue (CWE-401) where specially crafted malformed HTTP/2 requests can disrupt availability of NetScaler ADC/Gateway. The weakness is tied to HTTP/2 request parsing/handling when HTTP/2 is enabled.

Trigger/attack vector: Network-based requests directed at NetScaler ADC or NetScaler Gateway. Preconditions from the findings: HTTP/2 must be enabled in the HTTP Profile and that profile must be associated with the relevant virtual server (LB/CS/VPN) or the service configured on the device. No user interaction is required.

Exploitation status: Not listed in CISA KEV and no dated real-world exploitation claim is included in the provided findings. No public exploit code is on record.

Fix availability: Fixed versions are provided for both products: ADC/Gateway fixed in 72.61, 63.18, and 37.272.

EPSS: A prediction is provided (flat trend), but exploitation confirmation would override this; no KEV/news confirmation is included here.

CVE-2026-13474 is described as a NetScaler-specific HTTP/2 “Bomb” style DoS exploit, referenced as being based on an Apache HTTP Server vulnerability, but the actionable condition for NetScaler remains the HTTP/2 enabled configuration noted above.