External risk intelligence

NetScaler ADC and Gateway Memory Overflow Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-107410

NetScaler ADC and NetScaler Gateway are typically deployed as internet-facing edge appliances, load balancers, or remote access gateways. These components are intentionally exposed to the public internet to facilitate external traffic management and remote connectivity, placing them directly within the attack path of internet-based threats.

Denial of Service

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A memory overflow vulnerability in NetScaler Push can lead to unpredictable behavior or denial of service in NetScaler ADC and NetScaler Gateway products. The issue is exploitable remotely, meaning an attacker could trigger it without needing any access to the affected systems. Given the typical deployment of these products as internet-facing components, this vulnerability warrants attention to confirm relevance and exposure.

Flaw allows unexpected behavior or service disruption.
Affects internet-facing network access and load balancing.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted data to an exposed NetScaler device. This could lead to memory corruption within the NetScaler Push component, potentially causing system instability or denial of service.

No authentication or special privileges needed.
Sending malformed data triggers overflow.
Can cause denial of service or instability.

Live Threat

Current exploitation, exposure, and threat context

A memory overflow in NetScaler Push could cause unpredictable behavior or denial of service when supported by the advisory.

System stability and service availability.
Unpredictable behavior or denial of service.
Disruption of network traffic management.

Operational Fix

Recommended remediation, mitigation, and detection steps

The NetScaler Push memory overflow impacts NetScaler ADC and NetScaler Gateway, which are commonly deployed as internet-facing edge appliances. Given their exposure, infrastructure and security teams are likely responsible for identifying affected systems, assessing their reachability and business criticality, and determining the appropriate remediation strategy. The first practical step is to locate these deployments, verify their exposure, confirm ownership, and then plan for mitigation based on the identified risk.

Identify affected NetScaler deployments.
Verify external reachability and criticality.
Plan remediation with appropriate owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is NetScaler ADC and Gateway?

NetScaler ADC is a software-based application delivery controller used for load balancing and optimizing network traffic. NetScaler Gateway provides secure remote access for users. Together, they function as critical edge appliances that manage how traffic enters and moves through an organization's internal network environment.

What does memory overflow mean in CVE-2026-107410?

A memory overflow occurs when a program writes more data to a buffer than it can hold, overwriting adjacent memory. In this case, the NetScaler Push component fails to handle incoming data correctly. This corruption can lead to unpredictable system behavior or a crash, resulting in a denial of service where the device stops functioning.

How is this vulnerability triggered?

An attacker triggers the vulnerability by sending specially crafted, malformed data to the NetScaler Push component over the network. Crucially, the attacker does not need to provide any authentication or have prior access to the system to initiate this process. The flaw is not triggered by legitimate, well-formed traffic patterns.

Why should I care about this vulnerability?

According to Halo Surface Signal, NetScaler products are frequently deployed as internet-facing edge appliances. Because they sit at the perimeter to manage external traffic and remote connectivity, they are directly accessible to internet-based threats, making this a high-priority issue for any organization running these services.

How do I respond to this threat?

Your first step is to perform an inventory of your environment to locate all NetScaler ADC and Gateway deployments. Once identified, verify their network reachability and business criticality. Coordinate with the relevant system owners to assess your exposure and prepare for mitigation steps provided by the vendor.

References

support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697305

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.