External risk intelligence

NetScaler ADC and Gateway DNS Memory Corruption Leads to Denial of Service

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-107408

NetScaler ADC and NetScaler Gateway are edge networking appliances designed to be deployed at the network perimeter to provide load balancing, traffic management, and remote access. Because these products act as gateways for internet-facing traffic and DNS-over-HTTPS services, they are public-facing by design in normal deployment scenarios.

Denial of Service

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A memory corruption vulnerability exists within the DNS and DNS-over-HTTPS functionalities of NetScaler ADC and NetScaler Gateway. This could lead to unpredictable system behavior or service disruptions. The primary concern is to confirm if these specific technologies are in use and assess potential exposure.

A flaw in DNS handling could cause system issues.
Matters for leaders if internet-facing gateways are used.
Confirm if these systems are relevant to your environment.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerable component by sending specially crafted DNS queries over HTTPS to NetScaler ADC or NetScaler Gateway. This could lead to memory corruption, causing the system to behave unpredictably or become unresponsive.

No authentication or user interaction required.
Triggered by sending malicious DNS queries.
Risk of denial of service and erratic behavior.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact the stability and availability of NetScaler ADC and NetScaler Gateway by causing memory corruption within their DNS and DNS-over-HTTPS services. This could lead to unpredictable errors or a complete denial of service when these services are accessed.

Service availability and stability.
Memory corruption via network access.
Denial of service or erratic behavior.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in NetScaler ADC and NetScaler Gateway's DNS/DoH component requires immediate attention from the infrastructure and security teams responsible for these edge network appliances. The first practical step is to identify all instances of the affected technology, confirm their exposure to the internet, and determine their business criticality. Once these factors are understood, the accountable owner must be identified to plan a risk-based remediation strategy.

Infrastructure and security teams own this.
Verify external reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is NetScaler ADC and NetScaler Gateway?

These are networking appliances that sit at the edge of an organization's network. They act as traffic managers, load balancers, and secure gateways, specifically designed to handle and route internet-facing traffic and manage remote access services.

How does CVE-2026-107408 impact system memory?

This vulnerability involves memory corruption within the DNS and DNS-over-HTTPS (DoH) components. Essentially, the software fails to properly handle certain data inputs, which can overwrite or disrupt the memory the system uses to operate, leading to system crashes or unpredictable behavior.

Do I need to be logged in to trigger this vulnerability?

No. The vulnerability does not require authentication or any form of user interaction. An attacker can trigger the memory corruption simply by sending specially crafted DNS queries over HTTPS to the appliance, meaning the system can be targeted remotely without prior access.

Why should I care about this if my device is internal?

Halo Surface Signal indicates that these products are designed to be public-facing as gateways. While external-facing appliances are the primary concern, any device running these services is susceptible; you should verify if your specific instances are accessible from the internet or if they perform critical DNS routing roles.

What is the first step to address CVE-2026-107408?

Start by identifying all instances of NetScaler ADC or NetScaler Gateway in your environment. Once identified, confirm their internet reachability and business criticality, then coordinate with your infrastructure and security teams to plan a remediation strategy based on your specific risk profile.

References

support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697305

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.