{"id":"CVE-2026-107414","kind":"vulnerability","aliases":["CVE-2026-107414"],"related":[],"title":"Citrix NetScaler ADC and Gateway: heap overflow in WebAuth authentication can cause denial of service","description":"Memory overflow in WebAuth authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.","summary":"A memory overflow in the WebAuth authentication component of Citrix NetScaler ADC and NetScaler Gateway can cause unpredictable or erroneous behavior. The sources say it can lead to denial of service.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NetScaler ADC","fixed":["14.1-73.57"],"affected":"< 14.1-73.57","ecosystem":"vendor"},{"name":"NetScaler ADC 13.1","fixed":["13.1-64.39"],"affected":"< 13.1-64.39","ecosystem":"vendor"},{"name":"NetScaler Gateway","fixed":["14.1-73.57"],"affected":"< 14.1-73.57","ecosystem":"vendor"},{"name":"NetScaler ADC FIPS","fixed":["14.1-73.58"],"affected":"< 14.1-73.58","ecosystem":"vendor"}],"ecosystems":[],"tags":["citrix","denial-of-service","infrastructure","netscaler","netscaler-gateway","self-hosted","webauth"],"not_affected_if":["no-webauth-action"],"how_to_check":"Inspect the NetScaler running config for a line matching 'add authentication webAuthAction .*'. If present and the build is older than the fixed versions (show version), the appliance is exposed.","fix":"Upgrade to 14.1-73.57 or later (14.1), 13.1-64.39 or later (13.1), 14.1-73.58 FIPS or later (14.1-FIPS), 13.1-37.293 or later (13.1-FIPS and 13.1-NDcPP). Citrix lists no workaround.","status":"open","published_at":"2026-11-13T03:17:29+00:00","first_seen_at":"2026-11-13T03:42:55+00:00","triaged_at":"2026-11-13T03:43:16+00:00","updated_at":"2026-11-13T03:43:49+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-13T03:43:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Citrix NetScaler: WebAuth memory overflow allows denial of service or erratic behavior","impact":"medium","summary":"A memory overflow in the WebAuth authentication component of Citrix NetScaler ADC and NetScaler Gateway can cause unpredictable or erroneous behavior. The sources say it can lead to denial of service.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["citrix","netscaler","netscaler-gateway"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Appliance crashes or behaves erratically, causing denial of service","analyst_note":"Check the Citrix security bulletin for affected and fixed NetScaler versions and whether WebAuth exposure needs authentication.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Citrix NetScaler ADC or NetScaler Gateway with WebAuth authentication are the ones exposed. The sources do not say which configurations or versions are affected.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000674,"input_tokens":4523,"output_tokens":444,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Citrix security bulletin for affected and fixed NetScaler versions and whether WebAuth exposure needs authentication.","search":"'-107414':18A,21A '-2026':17A,20A '13.1':26A 'adc':3A,23A,25A,30A,57B,96C 'authent':10A,52B,81C 'behavior':66B,88C 'caus':12A,62B 'citrix':1A,32B,55B,94C,98C 'compon':53B 'cve':16A,19A 'denial':13A,34B,74B,90C 'denial-of-servic':33B 'erron':65B,87C 'fips':31A 'gateway':5A,28A,41B,60B,100C 'heap':6A 'host':44B 'infrastructur':37B 'lead':72B,83C 'memori':47B,77C 'netscal':2A,38B,40B,56B,59B,95C,99C 'netscaler':22A,24A,27A,29A 'netscaler-gateway':39B 'overflow':7A,48B,78C 'say':69B 'self':43B 'self-host':42B 'servic':15A,36B,76B,92C 'sourc':68B 'unpredict':63B,85C 'webauth':9A,45B,51B,80C","nicknames":[],"mitigations":[],"who_affected":"NetScaler ADC and NetScaler Gateway appliances configured with a WebAuth authentication action, on 14.1 before 14.1-73.57, 13.1 before 13.1-64.39, 14.1-FIPS before 14.1-73.58, and 13.1-FIPS/NDcPP before 13.1-37.293. Citrix lists the only precondition as a WebAuth action; the CVSS vector shows network-reachable, no privileges. Appliances with no WebAuth action can skip it, though the same bulletin fixes other CVEs.","tier":"B","verified":{"fix":{"at":"2026-11-13T03:43:49Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3811},"products":{"at":"2026-11-13T03:43:49Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3811},"how_to_check":{"at":"2026-11-13T03:43:49Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3811},"who_affected":{"at":"2026-11-13T03:43:49Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3811}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adc","adc131","adcfips","gateway","netscaleradc","netscaleradc131","netscaleradcfips","netscalergateway"],"ptokens":["13","adc","fips","gateway","netscaler"],"labels":["citrix","denialofservice","high","infrastructure","netscaler","netscalergateway","selfhosted","webauth"],"campaign_type":null,"search_a":"'-107414':18A,21A '-2026':17A,20A '13.1':26A 'adc':3A,23A,25A,30A 'authent':10A 'caus':12A 'citrix':1A 'cve':16A,19A 'denial':13A 'fips':31A 'gateway':5A,28A 'heap':6A 'netscal':2A 'netscaler':22A,24A,27A,29A 'overflow':7A 'servic':15A 'webauth':9A","search_b":"'adc':57B 'authent':52B 'behavior':66B 'caus':62B 'citrix':32B,55B 'compon':53B 'denial':34B,74B 'denial-of-servic':33B 'erron':65B 'gateway':41B,60B 'host':44B 'infrastructur':37B 'lead':72B 'memori':47B 'netscal':38B,40B,56B,59B 'netscaler-gateway':39B 'overflow':48B 'say':69B 'self':43B 'self-host':42B 'servic':36B,76B 'sourc':68B 'unpredict':63B 'webauth':45B,51B","search_c":"'adc':96C 'authent':81C 'behavior':88C 'citrix':94C,98C 'denial':90C 'erron':87C 'gateway':100C 'lead':83C 'memori':77C 'netscal':95C,99C 'overflow':78C 'servic':92C 'unpredict':85C 'webauth':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T03:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107414","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107414","severity":null,"published_at":"2026-11-13T03:17:29+00:00","modified_at":"2026-11-13T03:17:29+00:00","first_seen_at":"2026-11-13T03:42:55+00:00","fetched_at":"2026-11-13T03:42:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107414:3811","url":"https://support.citrix.com/external/article/CTX697305","severity":null,"published_at":"2026-11-13T03:43:49+00:00","modified_at":"2026-11-13T03:43:49+00:00","first_seen_at":"2026-11-13T03:43:49+00:00","fetched_at":"2026-11-13T03:43:49+00:00","note":"Read Citrix bulletin CTX697305: CVE-2026-107414 CWE-122 heap overflow, precondition WebAuth action configured; fixed builds listed. No exploitation or PoC stated; X/social not searched. 13.1-FIPS/NDcPP < 13.1-37.293 is in the bulletin but not a separate product row.","cites":["https://support.citrix.com/external/article/CTX697305"]}],"documents":[{"id":142058,"url":"https://support.citrix.com/external/article/CTX697305","title":"Citrix NetScaler ADC and Gateway Security Bulletin (CTX697305)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}