{"id":"CVE-2026-107415","kind":"vulnerability","aliases":["CVE-2026-107415"],"related":[],"title":"Citrix NetScaler ADC/Gateway: heap overflow in Email OTP authentication can cause denial of service","description":"Memory overflow in Email OTP authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.","summary":"Citrix bulletin CTX697305 describes a heap-based buffer overflow (CWE-122, CVSS v4 9.3, network, no auth or user interaction) in Email OTP authentication on NetScaler ADC and Gateway. It can lead to unpredictable or erroneous behavior or denial of service. Citrix does not say code execution is possible. Exposure needs an Email Action to be configured.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NetScaler ADC","fixed":["14.1-73.57","13.1-64.39","14.1-FIPS 14.1-73.58","13.1-FIPS 13.1-37.293"],"affected":"unknown","ecosystem":"vendor"},{"name":"NetScaler Gateway","fixed":["14.1-73.57","13.1-64.39"],"affected":"unknown","ecosystem":"vendor"}],"ecosystems":[],"tags":["citrix-netscaler","email-otp","infrastructure","netscaler-gateway","self-hosted"],"not_affected_if":["no-email-action"],"how_to_check":"Search the NetScaler running config (ns.conf) for entries matching: add authentication emailAction .* (Citrix's own check). If none, the precondition is not met. Then confirm the build is at or above the fixed build for your branch (show version).","fix":"Upgrade to 14.1-73.57 or later, 13.1-64.39 or later (13.1), 14.1-FIPS 14.1-73.58 or later, or 13.1-FIPS/13.1-NDcPP 13.1-37.293 or later.","status":"open","published_at":"2026-11-13T04:17:36+00:00","first_seen_at":"2026-11-13T04:42:39+00:00","triaged_at":"2026-11-13T04:43:49+00:00","updated_at":"2026-11-13T04:44:57+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-13T04:43:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Citrix NetScaler: Email OTP memory overflow enables denial of service and erratic behavior","impact":"medium","summary":"A memory overflow in the Email OTP authentication feature of Citrix NetScaler ADC and NetScaler Gateway can cause unpredictable or erroneous behavior. The sources describe the impact as denial of service; they do not say whether code execution is possible.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["citrix-netscaler","netscaler-gateway","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Denial of service and unpredictable device behavior on the gateway","analyst_note":"Find the Citrix advisory for CVE-2026-107415 to confirm affected versions, fixed builds, and whether the Email OTP feature is the only trigger; NVD alone gives no product data.","how_to_check":"- Check whether Email OTP authentication is configured on NetScaler ADC or NetScaler Gateway.\n- Check the NetScaler firmware version against the affected ranges in the Citrix advisory: unknown.","plain_action":"","product_name":"Citrix NetScaler ADC and NetScaler Gateway","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Citrix NetScaler ADC or NetScaler Gateway with Email OTP authentication. The sources do not state which versions or configurations are affected, so the exact exposure is unknown.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000752,"input_tokens":4524,"output_tokens":600,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the Citrix advisory for CVE-2026-107415 to confirm affected versions, fixed builds, and whether the Email OTP feature is the only trigger; NVD alone gives no product data.","search":"'-107415':17A,20A '-122':49B '-2026':16A,19A '9.3':52B 'action':92B 'adc':22A,65B,116C 'adc/gateway':3A 'auth':55B 'authent':9A,62B,101C 'base':45B 'behavior':75B,108C 'buffer':46B 'bulletin':39B 'caus':11A 'citrix':1A,26B,38B,80B,114C,118C 'citrix-netscal':25B 'code':84B 'configur':95B 'ctx697305':40B 'cve':15A,18A 'cvss':50B 'cwe':48B 'denial':12A,77B,110C 'describ':41B 'email':7A,29B,60B,91B,99C 'email-otp':28B 'erron':74B,107C 'execut':85B 'exposur':88B 'gateway':24A,34B,67B,120C 'heap':4A,44B 'heap-bas':43B 'host':37B 'infrastructur':31B 'interact':58B 'lead':70B,103C 'memori':96C 'need':89B 'netscal':2A,27B,33B,64B,115C,119C 'netscaler':21A,23A 'netscaler-gateway':32B 'network':53B 'otp':8A,30B,61B,100C 'overflow':5A,47B,97C 'possibl':87B 'say':83B 'self':36B 'self-host':35B 'servic':14A,79B,112C 'unpredict':72B,105C 'user':57B 'v4':51B","nicknames":[],"mitigations":[],"who_affected":"Self-managed NetScaler ADC and NetScaler Gateway appliances with an Email Action configured (Email OTP in nFactor flows). Appliances without any 'add authentication emailAction' entry do not meet the precondition. Citrix-managed cloud instances are not addressed in the bulletin text I read.","tier":"B","verified":{"fix":{"at":"2026-11-13T04:44:57Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3817},"how_to_check":{"at":"2026-11-13T04:44:57Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3817}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adc","gateway","netscaleradc","netscalergateway"],"ptokens":["adc","gateway","netscaler"],"labels":["citrixnetscaler","critical","emailotp","infrastructure","netscalergateway","selfhosted"],"campaign_type":null,"search_a":"'-107415':17A,20A '-2026':16A,19A 'adc':22A 'adc/gateway':3A 'authent':9A 'caus':11A 'citrix':1A 'cve':15A,18A 'denial':12A 'email':7A 'gateway':24A 'heap':4A 'netscal':2A 'netscaler':21A,23A 'otp':8A 'overflow':5A 'servic':14A","search_b":"'-122':49B '9.3':52B 'action':92B 'adc':65B 'auth':55B 'authent':62B 'base':45B 'behavior':75B 'buffer':46B 'bulletin':39B 'citrix':26B,38B,80B 'citrix-netscal':25B 'code':84B 'configur':95B 'ctx697305':40B 'cvss':50B 'cwe':48B 'denial':77B 'describ':41B 'email':29B,60B,91B 'email-otp':28B 'erron':74B 'execut':85B 'exposur':88B 'gateway':34B,67B 'heap':44B 'heap-bas':43B 'host':37B 'infrastructur':31B 'interact':58B 'lead':70B 'need':89B 'netscal':27B,33B,64B 'netscaler-gateway':32B 'network':53B 'otp':30B,61B 'overflow':47B 'possibl':87B 'say':83B 'self':36B 'self-host':35B 'servic':79B 'unpredict':72B 'user':57B 'v4':51B","search_c":"'adc':116C 'authent':101C 'behavior':108C 'citrix':114C,118C 'denial':110C 'email':99C 'erron':107C 'gateway':120C 'lead':103C 'memori':96C 'netscal':115C,119C 'otp':100C 'overflow':97C 'servic':112C 'unpredict':105C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T04:17:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107415","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107415","severity":null,"published_at":"2026-11-13T04:17:36+00:00","modified_at":"2026-11-13T04:17:36+00:00","first_seen_at":"2026-11-13T04:42:39+00:00","fetched_at":"2026-11-13T04:42:39+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107415:3817","url":"https://support.citrix.com/external/article/CTX697305","severity":null,"published_at":"2026-11-13T04:44:57+00:00","modified_at":"2026-11-13T04:44:57+00:00","first_seen_at":"2026-11-13T04:44:57+00:00","fetched_at":"2026-11-13T04:44:57+00:00","note":"Read Citrix bulletin CTX697305 (part of a 12+ CVE NetScaler bulletin, Nov 12 2026). Precondition, CWE-122, CVSS 9.3 and fixed builds confirmed; bulletin text I got did not list affected version ranges (page truncated), so no affected range. X/community not searched; no exploitation reported by sources.","cites":["https://support.citrix.com/external/article/CTX697305"]}],"documents":[{"id":142058,"url":"https://support.citrix.com/external/article/CTX697305","title":"Citrix NetScaler ADC and Gateway Security Bulletin CTX697305","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}