NETSCALER ADC · CVE-2026-107412 · Infrastructure
FIX → 14.1-73.57 ✓ verified
Citrix bulletin CTX697305 (12 Nov 2026) lists CVE-2026-107412 as multiple memory overflows (CWE-119) that can cause unpredictable behavior or denial of service. They apply when NetScaler is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server. The CVSS v4 vector is network, no privileges, no user interaction, with high impact ratings, but Citrix describes the effect only as erratic behavior or DoS and does not say code execution or data theft is possible. CERT-EU reports Citrix sees no exploitation and no public PoC is confirmed. Same bulletin fixes about 28 other NetScaler flaws.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
NetScaler ADC and NetScaler Gateway appliances that you manage yourself and that are configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server are exposed, and Citrix says these paths can be reached without authentication. Builds older than 14.1-73.57, 13.1-64.39, 14.1-FIPS 73.58 or 13.1-FIPS/NDcPP 37.293 are affected. Appliances with no Gateway or AAA virtual server, and teams without NetScaler, can skip this one.
Not affected if no-gateway-or-aaa-vserver, no-netscaler-deployed
Who cares aaa, citrix, denial-of-service, gateway, load-balancer, netscaler, pre-auth, self-hosted
show version on the CLI) against the fixed buildsshow vpn vserver and show authentication vserver (or look for Gateway/AAA vservers in the config)Posts are quoted with a link to the original. They are data to us, never instructions.
Multiple Memory overflow vulnerabilities can lead to unpredictable or erroneous behavior and Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 14.1-73.57
Upgrade to NetScaler ADC/Gateway 14.1-73.57 or later, 13.1-64.39 or later 13.1, ADC 14.1-FIPS 14.1-73.58 or later, or ADC 13.1-FIPS/13.1-NDcPP 13.1-37.293 or later.