{"id":"CVE-2026-107412","kind":"vulnerability","aliases":["CVE-2026-107412"],"related":[],"title":"Citrix NetScaler Gateway and AAA servers: memory overflows reachable without login can crash the appliance","description":"Multiple Memory overflow vulnerabilities can lead to unpredictable or erroneous behavior and Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.","summary":"Citrix bulletin CTX697305 (12 Nov 2026) lists CVE-2026-107412 as multiple memory overflows (CWE-119) that can cause unpredictable behavior or denial of service. They apply when NetScaler is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server. The CVSS v4 vector is network, no privileges, no user interaction, with high impact ratings, but Citrix describes the effect only as erratic behavior or DoS and does not say code execution or data theft is possible. CERT-EU reports Citrix sees no exploitation and no public PoC is confirmed. Same bulletin fixes about 28 other NetScaler flaws.","severity":"critical","cvss":9.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NetScaler ADC","fixed":["14.1-73.57"],"affected":"< 14.1-73.57","ecosystem":"vendor"},{"name":"NetScaler Gateway","fixed":["14.1-73.57"],"affected":"< 14.1-73.57","ecosystem":"vendor"}],"ecosystems":[],"tags":["aaa","citrix","denial-of-service","gateway","infrastructure","load-balancer","netscaler","pre-auth","self-hosted"],"not_affected_if":["no-gateway-or-aaa-vserver","no-netscaler-deployed"],"how_to_check":"Check the NetScaler firmware version (System > System Information, or 'show version' on the CLI) against the fixed builds. Then check exposure: run 'show vpn vserver' and 'show authentication vserver' (or look for Gateway/AAA vservers in the config). If neither exists, this CVE's precondition is not met, though other CVEs in the same bulletin may still apply. Prioritize internet-facing Gateway and AAA appliances. Secure Private Access Hybrid deployments using NetScaler instances also need the upgrade (per CIRCL mirror of the bulletin).","fix":"Upgrade to NetScaler ADC/Gateway 14.1-73.57 or later, 13.1-64.39 or later 13.1, ADC 14.1-FIPS 14.1-73.58 or later, or ADC 13.1-FIPS/13.1-NDcPP 13.1-37.293 or later.","status":"open","published_at":"2026-11-13T03:17:28+00:00","first_seen_at":"2026-11-13T03:42:55+00:00","triaged_at":"2026-11-13T03:43:17+00:00","updated_at":"2026-11-13T03:44:55+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-13T03:43:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Citrix NetScaler ADC and Gateway: memory overflows cause crashes and denial of service","impact":"medium","summary":"Multiple memory overflow flaws in Citrix NetScaler ADC and NetScaler Gateway can cause unpredictable behavior and denial of service. The sources do not state whether an attacker can run code or read data.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["netscaler","citrix","load-balancer","gateway"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Appliance crashes or behaves erratically; denial of service; code execution not stated","analyst_note":"Get affected versions, fixed versions and the attack vector from the Citrix security bulletin for CVE-2026-107412; the NVD entry alone does not state them.","how_to_check":"- Check the installed NetScaler ADC and NetScaler Gateway firmware version against the affected ranges in the Citrix advisory, which the sources do not reproduce\n- unknown for other checks: the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-netscaler-deployed"],"who_is_affected":"NetScaler ADC and NetScaler Gateway appliances are exposed. The sources do not list affected versions, configurations or whether management or internet-facing features are required. Teams without NetScaler appliances can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000735,"input_tokens":4528,"output_tokens":565,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Get affected versions, fixed versions and the attack vector from the Citrix security bulletin for CVE-2026-107412; the NVD entry alone does not state them.","search":"'-107412':18A,21A,53B '-119':59B '-2026':17A,20A,52B '12':47B '2026':49B '28':145B 'aaa':5A,26B,87B 'adc':23A,167C 'appli':70B 'applianc':15A 'auth':40B 'balanc':36B 'behavior':64B,113B,159C 'bulletin':45B,142B 'caus':62B 'cert':128B 'cert-eu':127B 'citrix':1A,27B,44B,106B,131B,165C,169C 'code':120B 'configur':74B 'confirm':140B 'crash':13A 'ctx697305':46B 'cve':16A,19A,51B 'cvpn':82B 'cvss':91B 'cwe':58B 'data':123B 'denial':29B,66B,161C 'denial-of-servic':28B 'describ':107B 'dos':115B 'effect':109B 'errat':112B 'erron':158C 'eu':129B 'execut':121B 'exploit':134B 'fix':143B 'flaw':148B 'gateway':3A,25A,32B,77B,171C 'high':102B 'host':43B 'ica':80B 'impact':103B 'infrastructur':33B 'interact':100B 'lead':154C 'list':50B 'load':35B 'load-balanc':34B 'login':11A 'memori':7A,56B,150C 'multipl':55B,149C 'netscal':2A,37B,72B,147B,166C,170C 'netscaler':22A,24A 'network':95B 'nov':48B 'overflow':8A,57B,151C 'poc':138B 'possibl':126B 'pre':39B 'pre-auth':38B 'privileg':97B 'proxi':81B,84B 'public':137B 'rate':104B 'rdp':83B 'reachabl':9A 'report':130B 'say':119B 'see':132B 'self':42B 'self-host':41B 'server':6A,89B 'servic':31B,68B,163C 'ssl':78B 'theft':124B 'unpredict':63B,156C 'user':99B 'v4':92B 'vector':93B 'virtual':88B 'vpn':79B 'vulner':152C 'without':10A","nicknames":[],"mitigations":[],"who_affected":"NetScaler ADC and NetScaler Gateway appliances that you manage yourself and that are configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server are exposed, and Citrix says these paths can be reached without authentication. Builds older than 14.1-73.57, 13.1-64.39, 14.1-FIPS 73.58 or 13.1-FIPS/NDcPP 37.293 are affected. Appliances with no Gateway or AAA virtual server, and teams without NetScaler, can skip this one.","tier":"B","verified":{"fix":{"at":"2026-11-13T03:44:55Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3812},"who_affected":{"at":"2026-11-13T03:44:55Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3812}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adc","gateway","netscaleradc","netscalergateway"],"ptokens":["adc","gateway","netscaler"],"labels":["aaa","citrix","critical","denialofservice","gateway","infrastructure","loadbalancer","netscaler","preauth","selfhosted"],"campaign_type":null,"search_a":"'-107412':18A,21A '-2026':17A,20A 'aaa':5A 'adc':23A 'applianc':15A 'citrix':1A 'crash':13A 'cve':16A,19A 'gateway':3A,25A 'login':11A 'memori':7A 'netscal':2A 'netscaler':22A,24A 'overflow':8A 'reachabl':9A 'server':6A 'without':10A","search_b":"'-107412':53B '-119':59B '-2026':52B '12':47B '2026':49B '28':145B 'aaa':26B,87B 'appli':70B 'auth':40B 'balanc':36B 'behavior':64B,113B 'bulletin':45B,142B 'caus':62B 'cert':128B 'cert-eu':127B 'citrix':27B,44B,106B,131B 'code':120B 'configur':74B 'confirm':140B 'ctx697305':46B 'cve':51B 'cvpn':82B 'cvss':91B 'cwe':58B 'data':123B 'denial':29B,66B 'denial-of-servic':28B 'describ':107B 'dos':115B 'effect':109B 'errat':112B 'eu':129B 'execut':121B 'exploit':134B 'fix':143B 'flaw':148B 'gateway':32B,77B 'high':102B 'host':43B 'ica':80B 'impact':103B 'infrastructur':33B 'interact':100B 'list':50B 'load':35B 'load-balanc':34B 'memori':56B 'multipl':55B 'netscal':37B,72B,147B 'network':95B 'nov':48B 'overflow':57B 'poc':138B 'possibl':126B 'pre':39B 'pre-auth':38B 'privileg':97B 'proxi':81B,84B 'public':137B 'rate':104B 'rdp':83B 'report':130B 'say':119B 'see':132B 'self':42B 'self-host':41B 'server':89B 'servic':31B,68B 'ssl':78B 'theft':124B 'unpredict':63B 'user':99B 'v4':92B 'vector':93B 'virtual':88B 'vpn':79B","search_c":"'adc':167C 'behavior':159C 'citrix':165C,169C 'denial':161C 'erron':158C 'gateway':171C 'lead':154C 'memori':150C 'multipl':149C 'netscal':166C,170C 'overflow':151C 'servic':163C 'unpredict':156C 'vulner':152C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T03:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107412","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107412","severity":null,"published_at":"2026-11-13T03:17:28+00:00","modified_at":"2026-11-13T03:17:28+00:00","first_seen_at":"2026-11-13T03:42:55+00:00","fetched_at":"2026-11-13T03:42:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107412:3812","url":"https://support.citrix.com/external/article/CTX697305","severity":null,"published_at":"2026-11-13T03:44:55+00:00","modified_at":"2026-11-13T03:44:55+00:00","first_seen_at":"2026-11-13T03:44:55+00:00","fetched_at":"2026-11-13T03:44:55+00:00","note":"Read Citrix CTX697305: precondition and fixed builds from vendor page; affected 'before' ranges (14.1<73.57, 13.1<64.39, FIPS<73.58, 13.1-FIPS/NDcPP<37.293) seen via CIRCL mirror only, so products not verified. Vendor page text was truncated before the how-to-check steps. No exploitation per CERT-EU. X not searched. Severity left critical (CVSS 9.5 vendor).","cites":["https://support.citrix.com/external/article/CTX697305","https://cert.europa.eu/publications/security-advisories/2026-020/"]}],"documents":[{"id":142058,"url":"https://support.citrix.com/external/article/CTX697305","title":"Citrix NetScaler ADC and Gateway Security Bulletin (CTX697305)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":142460,"url":"https://cert.europa.eu/publications/security-advisories/2026-020/","title":"CERT-EU 2026-020: Critical vulnerabilities in Citrix NetScaler","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}