Citrix patched six vulnerabilities in NetScaler ADC and Gateway products, including CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-49975, and CVE-2026-13474 (HTTP/2 Bomb). Four are high-severity issues involving out-of-bounds reads, memory overflow, and arbitrary file reads. The HTTP/2 Bomb is a denial-of-service exploit targeting Apache HTTP Server, combining known attack techniques to disrupt service. The CitrixBleed-style vulnerability (CVE-2026-8451) affects the XML parser and can leak restricted memory if NetScaler is configured as a SAML IDP and specific conditions are met. Exploitation could lead to data leakage or device compromise when combined with memory corruption. The vulnerabilities are fixed in NetScaler ADC and Gateway versions 14.1-72.61, 13.1-63.18, and related FIPS versions. Customers should verify if vulnerable features are enabled in their deployments before patching.

Successful exploitation of these vulnerabilities can lead to information disclosure, denial-of-service conditions, and potentially full device compromise when combined with other issues. The HTTP/2 Bomb vulnerability can cause Apache HTTP Server instances to become unresponsive. The CitrixBleed-style vulnerability can leak sensitive memory contents from the NetScaler appliance, which may expose confidential data. The impact varies depending on the specific vulnerability and configuration of the NetScaler instance, particularly whether it is configured as a SAML IDP.

Citrix has released official patches addressing all six vulnerabilities in NetScaler ADC and NetScaler Gateway versions 14.1-72.61, 13.1-63.18, and corresponding FIPS versions. Customers should apply these patches as soon as possible. Since each vulnerability has different configuration-specific preconditions, organizations should evaluate their deployments to determine if vulnerable features are enabled. No additional mitigation steps are indicated beyond applying the official fixes.