VulnerabilityPublished 1 Jul 2026

Citrix Patches NetScaler Vulnerabilities, Including New ‘HTTP/2 Bomb’ Attack

Source SecurityWeek

Mentioned vulnerabilities

Fixed in 14.1-72.61 : patch affected systems soon.

Data as of 3 Jul 2026, 01:18 UTC

Severity

High

Rated by Threat Radar

Patch: Available – fixed in 14.1-72.61, 13.1-63.18, 13.1-37.272

What to do

AI-suggested

Citrix has released official patches addressing all six vulnerabilities in NetScaler ADC and NetScaler Gateway versions 14.1-72.61, 13.1-63.18, and corresponding FIPS versions. Customers should apply these patches as soon as possible. Since each vulnerability has different configuration-specific preconditions, organizations should evaluate their deployments to determine if vulnerable features are enabled. No additional mitigation steps are indicated beyond applying the official fixes.

Description

Citrix urges customers to patch NetScaler after fixing six vulnerabilities, including the HTTP/2 Bomb flaw and a high-severity CitrixBleed-style information disclosure bug. The post Citrix Patches NetScaler Vulnerabilities, Including New ‘HTTP/2 Bomb’ Attack appeared first on SecurityWeek .

Impact

Successful exploitation of these vulnerabilities can lead to information disclosure, denial-of-service conditions, and potentially full device compromise when combined with other issues. The HTTP/2 Bomb vulnerability can cause Apache HTTP Server instances to become unresponsive. The CitrixBleed-style vulnerability can leak sensitive memory contents from the NetScaler appliance, which may expose confidential data. The impact varies depending on the specific vulnerability and configuration of the NetScaler instance, particularly whether it is configured as a SAML IDP.

Summary

Citrix patched six vulnerabilities in NetScaler ADC and Gateway products, including CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-49975, and CVE-2026-13474 (HTTP/2 Bomb). Four are high-severity issues involving out-of-bounds reads, memory overflow, and arbitrary file reads. The HTTP/2 Bomb is a denial-of-service exploit targeting Apache HTTP Server, combining known attack techniques to disrupt service. The CitrixBleed-style vulnerability (CVE-2026-8451) affects the XML parser and can leak restricted memory if NetScaler is configured as a SAML IDP and specific conditions are met. Exploitation could lead to data leakage or device compromise when combined with memory corruption. The vulnerabilities are fixed in NetScaler ADC and Gateway versions 14.1-72.61, 13.1-63.18, and related FIPS versions. Customers should verify if vulnerable features are enabled in their deployments before patching.

References

securityweek.com/citrix-patches-netscaler-vulnerabilities-including-new-http-2-bomb-attack/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 1 Jul 2026, 11:21 UTC

References

Community reviews

Related threats