External risk intelligence

Citrix NetScaler ADC Gateway Memory Overflow Vulnerabilities

CVE advisorySeverity: CRITICAL (CVSS 9.5)

CVE-2026-107412

Citrix NetScaler ADC and NetScaler Gateway are enterprise-grade appliances designed specifically for deployment at the network edge to provide load balancing, application delivery, and remote access (VPN) services. These products are intended to be public-facing to facilitate external connectivity to internal resources, making them a primary internet-exposed gateway service.

Denial of Service

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Citrix NetScaler ADC and Gateway products. These memory overflow flaws can disrupt services and cause them to behave unexpectedly, potentially impacting the availability of applications and the gateway itself. The main concern is confirming relevance and exposure to these systems.

Flaws in NetScaler could cause service disruptions.
Understand potential impacts on critical gateway services.
Confirm if your NetScaler environment is exposed.

Attack Path

How an attacker could exploit the issue

An attacker could target Citrix NetScaler ADC and Gateway appliances by sending specially crafted network traffic. This traffic would exploit memory overflow vulnerabilities within these devices, which are often exposed to the internet for providing application delivery and remote access. Successful exploitation could lead to unpredictable behavior, denial of service, or other severe consequences.

Requires unauthenticated network access.
Triggers memory overflow vulnerabilities.
Leads to denial of service or unpredictable behavior.

Live Threat

Current exploitation, exposure, and threat context

Memory overflow vulnerabilities in Citrix NetScaler ADC and Gateway could lead to unpredictable behavior or denial of service when the products are publicly accessible.

System stability and availability.
Unexpected input or network traffic.
Service disruption and inaccessibility.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Citrix NetScaler ADC and Gateway, which can lead to memory overflows and denial of service, requires immediate attention from teams managing network edge services and application delivery. The first practical step is to identify all instances of these products, confirm their exposure and criticality, and then determine the accountable owner for remediation planning.

Network or platform teams likely own this.
Verify public exposure and asset criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Citrix NetScaler ADC and Gateway?

Citrix NetScaler ADC is a networking appliance used to optimize application delivery, while NetScaler Gateway serves as a secure remote access and VPN solution. Organizations deploy these systems at the network edge to manage traffic, ensure load balancing, and provide employees or users with secure access to internal applications and resources.

What does memory overflow mean in CVE-2026-107412?

A memory overflow occurs when a program attempts to write more data to a specific memory area than it is designed to hold. In this CVE, the software fails to properly manage this incoming data, which corrupts memory. This leads to unpredictable system behavior or a crash, effectively resulting in a denial of service where the gateway stops functioning correctly.

How is this vulnerability triggered?

An attacker triggers the vulnerability by sending specially crafted network traffic to the affected appliance. Importantly, the flaw is not triggered by standard, legitimate user interactions or typical traffic patterns. It requires malicious, malformed data specifically designed to exploit how the gateway handles memory during packet processing.

Is my organization at risk according to Halo Surface Signal?

Halo Surface Signal identifies these products as enterprise-grade appliances typically deployed at the network edge to facilitate external connectivity. Because their primary role is to act as a public-facing gateway for your internal resources, they are inherently exposed to the internet. If your instances are reachable from the public web, they fall into the high-risk category for this external-facing vulnerability.

What should I do if I manage these systems?

Your first step is to perform an inventory to locate every instance of NetScaler ADC and Gateway within your environment. Once identified, verify their network configuration to confirm which are exposed to the internet. Finally, determine who owns these assets so your team can prioritize and plan for the necessary remediation steps to protect your network edge.

References

support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697305

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.