Threats affecting pkg:deb/citrix/netscaler-adc

CVE-2026-107408 is a critical memory corruption vulnerability in the DNS and DNS-over-HTTPS (DoH) functionality of Citrix NetScaler ADC. This flaw can cause unpredictable or erroneous behavior, including denial of service. It affects multiple versions of Citrix NetScaler ADC prior to fixed releases. The vulnerability has a high CVSS 4.0 score of 9.3, indicating network exploitable with no privileges or user interaction required. Fixed versions have been released by Citrix.

CVE-2026-107407 is a critical memory overflow vulnerability in Citrix NetScaler ADC affecting SMPP traffic processing. This flaw can cause unpredictable or erroneous behavior, including denial of service. It affects versions prior to 14.1-73.58 and 13.1-64.39. The vulnerability has a high CVSS 4.0 score of 9.3, indicating severe impact with no required privileges or user interaction for exploitation. Fixed versions are available in 14.1-73.58 and 13.1-64.39 releases.

CVE-2026-88778 is a high-severity vulnerability in Citrix NetScaler ADC and Gateway involving predictable exact values derived from previous values. This weakness can affect versions before 14.1-73.37 and 13.1-64.23 for ADC and Gateway products, including certain FIPS and NDcPP variants. The vulnerability is classified under CWE-342, indicating issues with predictable values that may weaken security mechanisms.

Denial of service via malformed HTTP/2 requests in NetScaler ADC and NetScaler Gateway if HTTP/2 is enabled in HTTP Profile and associated with the virtual server (of type LB, CS, VPN) or the service configured on NetScaler