NETSCALER ADC · CVE-2026-107410 · Infrastructure
FIX → 14.1-73.57 · 13.1-64.39 · 14.1-73.58 · 13.1-37.293 ✓ verified
Heap-based buffer overflow (CWE-122) in NetScaler Push, CVSS v4 9.3 (network, no auth, no user interaction). Citrix says it can cause unpredictable behavior or denial of service. Only appliances with a Load Balancing vserver of type PUSH are affected. Citrix lists no workaround; upgrade.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Customer-managed NetScaler ADC and Gateway appliances (including FIPS/NDcPP builds) running a build before the fixed ones and configured with a Load Balancing virtual server of type PUSH. Secure Private Access Hybrid deployments that use NetScaler instances are also named by Citrix. Appliances without a PUSH vserver, and Citrix-managed cloud services (the bulletin covers only customer-managed products), can skip it.
Not affected if managed-hosting, no-push-vserver
Who cares adc, citrix, gateway, netscaler, self-hosted
Memory overflow in NetScaler Push can lead to unpredictable or erroneous behavior or Denial of Service in NetScaler ADC and NetScaler Gateway.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
add lb vserver <name> PUSH <IP> <Port>show ns version; affected if before 14.1-73.57, 13.1-64.39, 14.1-FIPS 14.1-73.58, or 13.1-FIPS/NDcPP 13.1-37.293Upgrade to 14.1-73.57 · 13.1-64.39 · 14.1-73.58 · 13.1-37.293
Upgrade to NetScaler ADC/Gateway 14.1-73.57 or later, 13.1-64.39 or later 13.1, 14.1-FIPS 14.1-73.58 or later, or 13.1-FIPS/13.1-NDcPP 13.1-37.293 or later.