External risk intelligence

Citrix NetScaler DoH Memory Corruption Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-107409

NetScaler ADC and NetScaler Gateway are typically deployed as internet-facing edge appliances. The vulnerability affects the DNS-over-HTTPS (DoH) service, which is a protocol designed specifically for network-level resolution, making the affected interface a public-facing service by design in common deployment patterns.

Denial of Service

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A memory corruption vulnerability has been identified in the DNS-over-HTTPS (DoH) functionality of NetScaler ADC and NetScaler Gateway, potentially leading to service disruptions or unpredictable behavior.

Affects DNS-over-HTTPS in NetScaler products.
Could impact service availability and stability.
Confirm relevance and exposure within your environment.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerable component by sending specially crafted DNS-over-HTTPS requests over the network. This could lead to memory corruption, causing the system to behave unpredictably or crash.

No special access required.
Triggered by network requests.
Risk of service disruption.

Live Threat

Current exploitation, exposure, and threat context

Memory corruption in the DNS-over-HTTPS (DoH) service within Citrix NetScaler could lead to unpredictable or erroneous service behavior. When supported by the advisory, this could manifest as a Denial of Service, impacting the availability of the DNS resolution service.

DoH service availability.
Network-based memory corruption.
Denial of Service impacting DNS resolution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This memory corruption vulnerability in Citrix NetScaler's DNS-over-HTTPS (DoH) service requires immediate attention from infrastructure and platform teams responsible for NetScaler deployments. The first practical step is to identify all instances of the affected technology, confirm their external reachability and business criticality, and then assign ownership for remediation planning.

Infrastructure and platform teams own this.
Verify DoH service exposure and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Citrix NetScaler and why is it used?

Citrix NetScaler acts as an application delivery controller and gateway. Organizations use it to manage network traffic, balance server loads, and secure access to web applications. It serves as a central point for processing connections, including specialized protocols like DNS-over-HTTPS, which helps encrypt domain name lookups to improve privacy.

What does memory corruption mean in the context of CVE-2026-107409?

Memory corruption occurs when a program inadvertently overwrites or accesses memory locations it should not. In this case, the DNS-over-HTTPS service handles data incorrectly, leading to internal errors. This flaw can cause the service to crash or behave in unexpected ways, preventing it from functioning correctly.

How is this vulnerability triggered in NetScaler?

An attacker triggers this bug by sending specially crafted network requests to the DNS-over-HTTPS service. This does not require any prior user authentication or special privileges. Simply sending the malicious data over the network is enough to impact the service; normal, properly formatted DNS traffic does not trigger the flaw.

Why is this CVE significant for my infrastructure?

This vulnerability is highly relevant because Halo Surface Signal identifies NetScaler devices as typically internet-facing edge appliances. Since the DNS-over-HTTPS service is designed for network-level resolution, it is often exposed to public traffic by default, making it reachable by any remote actor on the internet.

What should I do if I manage NetScaler devices?

Start by identifying all NetScaler instances in your environment and documenting which ones have the DNS-over-HTTPS feature enabled. Assess the business criticality of those specific systems to prioritize them. Coordinate with your infrastructure team to verify if the service is exposed to the internet and begin planning your remediation steps.

References

support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697305

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.