{"id":"CVE-2026-107410","kind":"vulnerability","aliases":["CVE-2026-107410"],"related":[],"title":"NetScaler ADC and Gateway: heap overflow in Push load-balancing vserver can crash or compromise the appliance","description":"Memory overflow in NetScaler Push can lead to unpredictable or erroneous behavior or Denial of Service in NetScaler ADC and NetScaler Gateway.","summary":"Heap-based buffer overflow (CWE-122) in NetScaler Push, CVSS v4 9.3 (network, no auth, no user interaction). Citrix says it can cause unpredictable behavior or denial of service. Only appliances with a Load Balancing vserver of type PUSH are affected. Citrix lists no workaround; upgrade.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NetScaler ADC","fixed":["14.1-73.57"],"affected":"< 14.1-73.57","ecosystem":"vendor"},{"name":"NetScaler Gateway","fixed":["14.1-73.57"],"affected":"< 14.1-73.57","ecosystem":"vendor"},{"name":"NetScaler ADC 13.1","fixed":["13.1-64.39"],"affected":"< 13.1-64.39","ecosystem":"vendor"},{"name":"NetScaler ADC 14.1-FIPS","fixed":["14.1-73.58"],"affected":"< 14.1-73.58","ecosystem":"vendor"},{"name":"NetScaler ADC 13.1-FIPS/NDcPP","fixed":["13.1-37.293"],"affected":"< 13.1-37.293","ecosystem":"vendor"}],"ecosystems":[],"tags":["adc","citrix","gateway","infrastructure","netscaler","self-hosted"],"not_affected_if":["managed-hosting","no-push-vserver"],"how_to_check":"Inspect the NetScaler config (ns.conf / show running config) for an LB vserver of type PUSH: 'add lb vserver <name> PUSH <IP> <Port>'. If none exists, the precondition is not met. Also check build: 'show ns version'; affected if before 14.1-73.57, 13.1-64.39, 14.1-FIPS 14.1-73.58, or 13.1-FIPS/NDcPP 13.1-37.293.","fix":"Upgrade to NetScaler ADC/Gateway 14.1-73.57 or later, 13.1-64.39 or later 13.1, 14.1-FIPS 14.1-73.58 or later, or 13.1-FIPS/13.1-NDcPP 13.1-37.293 or later.","status":"open","published_at":"2026-11-13T02:18:49+00:00","first_seen_at":"2026-11-13T02:41:36+00:00","triaged_at":"2026-11-13T02:42:52+00:00","updated_at":"2026-11-13T02:44:17+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-13T02:42:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"NetScaler ADC and Gateway: memory overflow in Push causes crash or misbehavior","impact":"medium","summary":"A memory overflow in the Push component of NetScaler ADC and NetScaler Gateway can cause unpredictable or erroneous behavior. The flaw can also be used to cause a Denial of Service, taking the appliance down.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["netscaler","citrix","gateway"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"appliance crashes or behaves erroneously, causing denial of service","analyst_note":"Check the NVD entry and the Citrix security bulletin for affected versions, fixed builds, and whether Push must be enabled.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"NetScaler ADC and NetScaler Gateway appliances with the Push component in use are named as affected by the description. The sources do not state which configurations or versions are vulnerable. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000671,"input_tokens":4519,"output_tokens":438,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the NVD entry and the Citrix security bulletin for affected versions, fixed builds, and whether Push must be enabled.","search":"'-107410':21A,24A '-122':54B '-2026':20A,23A '13.1':31A,38A '14.1':34A '9.3':60B 'adc':2A,26A,30A,33A,37A,40B,113C 'affect':89B 'applianc':18A,79B 'auth':63B 'balanc':11A,83B 'base':50B 'behavior':73B,106C 'buffer':51B 'caus':71B 'citrix':41B,67B,90B 'compromis':16A 'crash':14A 'cve':19A,22A 'cvss':58B 'cwe':53B 'denial':75B,108C 'erron':105C 'fips':35A 'fips/ndcpp':39A 'gateway':4A,28A,42B,116C 'heap':5A,49B 'heap-bas':48B 'host':47B 'infrastructur':43B 'interact':66B 'lead':101C 'list':91B 'load':10A,82B 'load-balanc':9A 'memori':95C 'netscal':1A,44B,56B,98C,112C,115C 'netscaler':25A,27A,29A,32A,36A 'network':61B 'overflow':6A,52B,96C 'push':8A,57B,87B,99C 'say':68B 'self':46B 'self-host':45B 'servic':77B,110C 'type':86B 'unpredict':72B,103C 'upgrad':94B 'user':65B 'v4':59B 'vserver':12A,84B 'workaround':93B","nicknames":[],"mitigations":[],"who_affected":"Customer-managed NetScaler ADC and Gateway appliances (including FIPS/NDcPP builds) running a build before the fixed ones and configured with a Load Balancing virtual server of type PUSH. Secure Private Access Hybrid deployments that use NetScaler instances are also named by Citrix. Appliances without a PUSH vserver, and Citrix-managed cloud services (the bulletin covers only customer-managed products), can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-13T02:44:17Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3801},"products":{"at":"2026-11-13T02:44:17Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3801},"how_to_check":{"at":"2026-11-13T02:44:17Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3801},"who_affected":{"at":"2026-11-13T02:44:17Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3801}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adc","adc131","adc131fipsndcpp","adc141fips","gateway","netscaleradc","netscaleradc131","netscaleradc131fipsndcpp","netscaleradc141fips","netscalergateway"],"ptokens":["13","14","adc","fips","gateway","ndcpp","netscaler"],"labels":["adc","citrix","critical","gateway","infrastructure","netscaler","selfhosted"],"campaign_type":null,"search_a":"'-107410':21A,24A '-2026':20A,23A '13.1':31A,38A '14.1':34A 'adc':2A,26A,30A,33A,37A 'applianc':18A 'balanc':11A 'compromis':16A 'crash':14A 'cve':19A,22A 'fips':35A 'fips/ndcpp':39A 'gateway':4A,28A 'heap':5A 'load':10A 'load-balanc':9A 'netscal':1A 'netscaler':25A,27A,29A,32A,36A 'overflow':6A 'push':8A 'vserver':12A","search_b":"'-122':54B '9.3':60B 'adc':40B 'affect':89B 'applianc':79B 'auth':63B 'balanc':83B 'base':50B 'behavior':73B 'buffer':51B 'caus':71B 'citrix':41B,67B,90B 'cvss':58B 'cwe':53B 'denial':75B 'gateway':42B 'heap':49B 'heap-bas':48B 'host':47B 'infrastructur':43B 'interact':66B 'list':91B 'load':82B 'netscal':44B,56B 'network':61B 'overflow':52B 'push':57B,87B 'say':68B 'self':46B 'self-host':45B 'servic':77B 'type':86B 'unpredict':72B 'upgrad':94B 'user':65B 'v4':59B 'vserver':84B 'workaround':93B","search_c":"'adc':113C 'behavior':106C 'denial':108C 'erron':105C 'gateway':116C 'lead':101C 'memori':95C 'netscal':98C,112C,115C 'overflow':96C 'push':99C 'servic':110C 'unpredict':103C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T02:18:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107410","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107410","severity":null,"published_at":"2026-11-13T02:18:49+00:00","modified_at":"2026-11-13T02:18:49+00:00","first_seen_at":"2026-11-13T02:41:36+00:00","fetched_at":"2026-11-13T02:41:36+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107410:3801","url":"https://support.citrix.com/external/article/CTX697305","severity":null,"published_at":"2026-11-13T02:44:17+00:00","modified_at":"2026-11-13T02:44:17+00:00","first_seen_at":"2026-11-13T02:44:17+00:00","fetched_at":"2026-11-13T02:44:17+00:00","note":"Read Citrix bulletin CTX697305 (web-cli get + WebFetch). Affected/fixed builds, PUSH vserver precondition, no workaround stated. No exploitation statement on page. X/social not searched; no sign of discussion needed for a fresh B.","cites":["https://support.citrix.com/external/article/CTX697305"]}],"documents":[{"id":142058,"url":"https://support.citrix.com/external/article/CTX697305","title":"Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin (CTX697305)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}