NETSCALER ADC · CVE-2026-107414 · Infrastructure
FIX → 14.1-73.57 · 13.1-64.39 · 14.1-73.58 ✓ verified
A memory overflow in the WebAuth authentication component of Citrix NetScaler ADC and NetScaler Gateway can cause unpredictable or erroneous behavior. The sources say it can lead to denial of service.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
NetScaler ADC and NetScaler Gateway appliances configured with a WebAuth authentication action, on 14.1 before 14.1-73.57, 13.1 before 13.1-64.39, 14.1-FIPS before 14.1-73.58, and 13.1-FIPS/NDcPP before 13.1-37.293. Citrix lists the only precondition as a WebAuth action; the CVSS vector shows network-reachable, no privileges. Appliances with no WebAuth action can skip it, though the same bulletin fixes other CVEs.
Not affected if no-webauth-action
Who cares citrix, denial-of-service, netscaler, netscaler-gateway, self-hosted, webauth
Memory overflow in WebAuth authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
add authentication webAuthAction .*Upgrade to 14.1-73.57 · 13.1-64.39 · 14.1-73.58