How do I check whether I am affected by CVE-2026-107408?

Check the build: 14.1 before 14.1-73.57, 13.1 before 13.1-64.39, 14.1-FIPS before 14.1-73.58, 13.1-FIPS/NDcPP before 13.1-37.293 is affected. Then look in the config for 'set dns parameter -recursion ENABLED' or 'add dns profile -recursiveResolution ENABLED', together with a DNS proxy vserver: 'add lb|cs vserver DNS|DNS_TCP|DOT ...' or 'add lb|cs vserver SSL ... -dnsOverHttps ENABLED'.

What is the fix for CVE-2026-107408?

Upgrade to 14.1-73.57 or later, 13.1-64.39 or later, 14.1-FIPS 14.1-73.58 or later, or 13.1-FIPS/13.1-NDcPP 13.1-37.293 or later. Citrix lists no workaround.

Post Share

CRITICAL9.3CVSS · 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5

NO KNOWN
EXPLOIT

NETSCALER ADC · CVE-2026-107408 · Infrastructure

NetScaler ADC and Gateway: DNS/DoH out-of-bounds write can crash the appliance

Q: Who is not affected by CVE-2026-107408?

Not affected if: no-dns-load-balancing, not-netscaler, recursion-disabled.

FIX → 14.1-73.57 · 13.1-64.39 +2 ✓ verified

Citrix bulletin CTX697305 describes memory corruption (CWE-787 out-of-bounds write) in DNS and DNS-over-HTTPS handling that can cause unpredictable behavior or denial of service. Citrix rates it CVSS v4 9.3. Citrix's precondition is NetScaler ADC configured for DNS load balancing and recursive DNS resolution. The bulletin does not say whether code execution is possible and does not mention exploitation.

Full story ↓Less ↑

first public Nov 13, 2026 · 2 sources

Check it with your coding agent

It reads this page and tells you if your code or app is affected.

Claude CodeCodexCursorAdd to your agent

01 · Who is affected

✓ Verified Nov 13

Self-managed NetScaler ADC appliances (and Gateway builds on the same releases) running an affected build and configured for DNS load balancing with recursive DNS resolution, including DNS-over-HTTPS vservers. Appliances without DNS recursion and DNS vservers do not meet Citrix's precondition, and teams without NetScaler can skip it.

NetScaler ADC14.1 < 14.1-73.57; 13.1 < 13.1-64.39; 14.1-FIPS < 14.1-73.58; 13.1-FIPS/NDcPP < 13.1-37.293fixed in 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS, 13.1-37.293 FIPS/NDcPP
NetScaler Gateway14.1 < 14.1-73.57; 13.1 < 13.1-64.39fixed in 14.1-73.57, 13.1-64.39

Not affected if no-dns-load-balancing, not-netscaler, recursion-disabled

Who cares citrix, dns, doh, gateway, netscaler, self-hosted

02 · How to check

✓ Verified Nov 13

Check the build: 14.1 before 14.1-73.57, 13.1 before 13.1-64.39, 14.1-FIPS before 14.1-73.58, 13.1-FIPS/NDcPP before 13.1-37.293 is affected
Then look in the config for set dns parameter -recursion ENABLED or add dns profile <name> -recursiveResolution ENABLED, together with a DNS proxy vserver: or

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 13, 2026

How it unfolded

2 events · Nov 13, 2026 → Nov 13, 2026

Nov 13, 202602:41 UTCNVD CVE-2026-107408
Nov 13, 202602:45 UTCInfraStack Analyst Read Citrix bulletin CTX697305: precondition is DNS load balancing plus recursive resolution (CWE-787 OOB write); fixed builds listed. No mitigation stated; no exploitation or PoC found.moreless

What the sources say, verbatim

156 characters

Memory corruption in DNS / DNS-over-HTTPS (DoH) can lead to unpredictable or erroneous behavior or Denial of Service in NetScaler ADC and NetScaler Gateway.

Sources and references

NVD: CVE-2026-107408Nov 13, 2026
Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin (CTX697305)Advisory · support.citrix.com

This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.

Are you affected?

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

InfraStack checks it against your stack and answers on your report, with the evidence and the fix.

Run the check

Get the next NetScaler ADC threat the day it hits your stack.

Start free

Post Share

CRITICAL9.3CVSS · 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5

NO KNOWN
EXPLOIT

NETSCALER ADC · CVE-2026-107408 · Infrastructure

NetScaler ADC and Gateway: DNS/DoH out-of-bounds write can crash the appliance

FIX → 14.1-73.57 · 13.1-64.39 +2 ✓ verified

Full story ↓Less ↑

first public Nov 13, 2026 · 2 sources

Check it with your coding agent

It reads this page and tells you if your code or app is affected.

Claude CodeCodexCursorAdd to your agent

01 · Who is affected

✓ Verified Nov 13

NetScaler ADC14.1 < 14.1-73.57; 13.1 < 13.1-64.39; 14.1-FIPS < 14.1-73.58; 13.1-FIPS/NDcPP < 13.1-37.293fixed in 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS, 13.1-37.293 FIPS/NDcPP
NetScaler Gateway14.1 < 14.1-73.57; 13.1 < 13.1-64.39fixed in 14.1-73.57, 13.1-64.39

Not affected if no-dns-load-balancing, not-netscaler, recursion-disabled

Who cares citrix, dns, doh, gateway, netscaler, self-hosted

02 · How to check

✓ Verified Nov 13

Check the build: 14.1 before 14.1-73.57, 13.1 before 13.1-64.39, 14.1-FIPS before 14.1-73.58, 13.1-FIPS/NDcPP before 13.1-37.293 is affected
Then look in the config for set dns parameter -recursion ENABLED or add dns profile <name> -recursiveResolution ENABLED, together with a DNS proxy vserver: or

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 13, 2026

How it unfolded

2 events · Nov 13, 2026 → Nov 13, 2026

Nov 13, 202602:41 UTCNVD CVE-2026-107408
Nov 13, 202602:45 UTCInfraStack Analyst Read Citrix bulletin CTX697305: precondition is DNS load balancing plus recursive resolution (CWE-787 OOB write); fixed builds listed. No mitigation stated; no exploitation or PoC found.moreless

What the sources say, verbatim

156 characters

Memory corruption in DNS / DNS-over-HTTPS (DoH) can lead to unpredictable or erroneous behavior or Denial of Service in NetScaler ADC and NetScaler Gateway.

Sources and references

NVD: CVE-2026-107408Nov 13, 2026
Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin (CTX697305)Advisory · support.citrix.com

NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.

Are you affected?

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

InfraStack checks it against your stack and answers on your report, with the evidence and the fix.

Run the check

Get the next NetScaler ADC threat the day it hits your stack.

Start free

NetScaler ADC and Gateway: DNS/DoH out-of-bounds write can crash the appliance

01 · Who is affected

02 · How to check

How it unfolded

What the sources say, verbatim

Sources and references

Read next

Get the next NetScaler ADC threat the day it hits your stack.

NetScaler ADC and Gateway: DNS/DoH out-of-bounds write can crash the appliance

01 · Who is affected

02 · How to check

How it unfolded

What the sources say, verbatim

Sources and references

Read next

Get the next NetScaler ADC threat the day it hits your stack.

03 · The fix