---
id: "CVE-2026-107410"
page: "https://infrastack.ai/live/CVE-2026-107410"
kind: "vulnerability"
aliases: ["CVE-2026-107410"]
title: "NetScaler ADC and Gateway: heap overflow in Push load-balancing vserver can crash or compromise the appliance"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "NetScaler ADC", "fixed": ["14.1-73.57"], "affected": "< 14.1-73.57", "ecosystem": "vendor"}, {"name": "NetScaler Gateway", "fixed": ["14.1-73.57"], "affected": "< 14.1-73.57", "ecosystem": "vendor"}, {"name": "NetScaler ADC 13.1", "fixed": ["13.1-64.39"], "affected": "< 13.1-64.39", "ecosystem": "vendor"}, {"name": "NetScaler ADC 14.1-FIPS", "fixed": ["14.1-73.58"], "affected": "< 14.1-73.58", "ecosystem": "vendor"}, {"name": "NetScaler ADC 13.1-FIPS/NDcPP", "fixed": ["13.1-37.293"], "affected": "< 13.1-37.293", "ecosystem": "vendor"}]
ecosystems: []
tags: ["adc", "citrix", "gateway", "infrastructure", "netscaler", "self-hosted"]
not_affected_if: ["managed-hosting", "no-push-vserver"]
published_at: "2026-11-13T02:18:49+00:00"
first_seen_at: "2026-11-13T02:41:36+00:00"
updated_at: "2026-11-13T02:44:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107410", "first_seen_at": "2026-11-13T02:41:36+00:00"}, {"source": "analyst", "url": "https://support.citrix.com/external/article/CTX697305", "first_seen_at": "2026-11-13T02:44:17+00:00", "cites": ["https://support.citrix.com/external/article/CTX697305"]}]
exploit_sources: []
---

# NetScaler ADC and Gateway: heap overflow in Push load-balancing vserver can crash or compromise the appliance

Link for people: https://infrastack.ai/live/CVE-2026-107410 (this .md is for agents)

Heap-based buffer overflow (CWE-122) in NetScaler Push, CVSS v4 9.3 (network, no auth, no user interaction). Citrix says it can cause unpredictable behavior or denial of service. Only appliances with a Load Balancing vserver of type PUSH are affected. Citrix lists no workaround; upgrade.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:NetScaler ADC affected < 14.1-73.57 fixed 14.1-73.57
- vendor:NetScaler Gateway affected < 14.1-73.57 fixed 14.1-73.57
- vendor:NetScaler ADC 13.1 affected < 13.1-64.39 fixed 13.1-64.39
- vendor:NetScaler ADC 14.1-FIPS affected < 14.1-73.58 fixed 14.1-73.58
- vendor:NetScaler ADC 13.1-FIPS/NDcPP affected < 13.1-37.293 fixed 13.1-37.293

## How to check

Inspect the NetScaler config (ns.conf / show running config) for an LB vserver of type PUSH: 'add lb vserver <name> PUSH <IP> <Port>'. If none exists, the precondition is not met. Also check build: 'show ns version'; affected if before 14.1-73.57, 13.1-64.39, 14.1-FIPS 14.1-73.58, or 13.1-FIPS/NDcPP 13.1-37.293.

## Fix

Upgrade to NetScaler ADC/Gateway 14.1-73.57 or later, 13.1-64.39 or later 13.1, 14.1-FIPS 14.1-73.58 or later, or 13.1-FIPS/13.1-NDcPP 13.1-37.293 or later.

## Timeline

- 2026-11-13T02:41:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107410
- 2026-11-13T02:44:17+00:00 analyst https://support.citrix.com/external/article/CTX697305 — Read Citrix bulletin CTX697305 (web-cli get + WebFetch). Affected/fixed builds, PUSH vserver precondition, no workaround stated. No exploitation statement on page. X/social not searched; no sign of discussion needed for a fresh B.

## Documents

- [advisory] Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin (CTX697305) https://support.citrix.com/external/article/CTX697305

## From the sources

Memory overflow in NetScaler Push can lead to unpredictable or erroneous behavior or Denial of Service in NetScaler ADC and NetScaler Gateway.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_