Threats affecting pkg:rpm/citrix/netscaler-adc

CVE-2026-111342 is a high-severity vulnerability in Citrix NetScaler ADC and NetScaler Gateway involving a memory overflow during LDAP authentication. This flaw can cause unpredictable or erroneous behavior, including denial of service. The issue affects versions prior to 14.1-73.58 and 13.1-64.39, with fixes available in these and related releases.

CVE-2026-111340 is a high-severity memory overflow vulnerability in the knowledge-based authentication (KBA) component of Citrix NetScaler ADC and NetScaler Gateway. This flaw can cause unpredictable or erroneous behavior, including denial of service. The vulnerability affects multiple versions prior to specific fixed releases. No known exploits are reported in the wild.

CVE-2026-107415 is a critical memory overflow vulnerability in the Email OTP authentication component of Citrix NetScaler ADC and NetScaler Gateway. This flaw can cause unpredictable or erroneous behavior, including denial of service. It affects specific versions prior to fixed releases. The vulnerability has a high CVSS 4.0 score of 9.3, indicating severe impact if exploited.

CVE-2026-107414 is a high-severity vulnerability in Citrix NetScaler ADC and NetScaler Gateway involving a memory overflow in the WebAuth authentication component. This flaw can cause unpredictable or erroneous behavior, including denial of service. The issue affects multiple versions prior to specific fixed releases. A fix is available in versions 14.1-73.58 FIPS, 14.1-73.57, 13.1-64.39, and 13.1-37.293 FIPS and NDcPP.

A memory overflow vulnerability exists in the SAML authentication component of Citrix NetScaler ADC and Gateway. This flaw can cause unpredictable or erroneous behavior, including denial of service. The issue affects multiple versions prior to specific fixed releases. The vulnerability has a high severity score and does not require user interaction or privileges to exploit.

CVE-2026-107411 is a high-severity vulnerability in Citrix NetScaler ADC involving a memory overflow in the RTSP ALG component. This flaw can cause unpredictable or erroneous behavior, including denial of service. The issue affects versions prior to 14.1-73.58 and 13.1-64.39, with fixes available in these and related releases.

CVE-2026-107410 is a critical memory overflow vulnerability in Citrix NetScaler ADC's NetScaler Push component. This flaw can cause unpredictable or erroneous behavior, including denial of service. It affects versions prior to 14.1-73.58 and 13.1-64.39. The vulnerability has a high CVSS 4.0 score of 9.3, indicating severe impact if exploited. No known exploits are reported in the wild at this time.

CVE-2026-107409 is a critical memory corruption vulnerability in the DNS-over-HTTPS (DoH) implementation of Citrix NetScaler ADC. This flaw can cause unpredictable or erroneous behavior, including denial of service conditions. The vulnerability affects multiple versions prior to specific fixed releases. A high-severity CVSS 4.0 score of 9.3 reflects the potential impact of this issue.

CVE-2026-107408 is a critical memory corruption vulnerability in the DNS and DNS-over-HTTPS (DoH) functionality of Citrix NetScaler ADC. This flaw can cause unpredictable or erroneous behavior, including denial of service. It affects multiple versions of Citrix NetScaler ADC prior to fixed releases. The vulnerability has a high CVSS 4.0 score of 9.3, indicating network exploitable with no privileges or user interaction required. Fixed versions have been released by Citrix.

CVE-2026-107407 is a critical memory overflow vulnerability in Citrix NetScaler ADC affecting SMPP traffic processing. This flaw can cause unpredictable or erroneous behavior, including denial of service. It affects versions prior to 14.1-73.58 and 13.1-64.39. The vulnerability has a high CVSS 4.0 score of 9.3, indicating severe impact with no required privileges or user interaction for exploitation. Fixed versions are available in 14.1-73.58 and 13.1-64.39 releases.

CVE-2026-88778 is a high-severity vulnerability in Citrix NetScaler ADC and Gateway involving predictable exact values derived from previous values. This weakness can affect versions before 14.1-73.37 and 13.1-64.23 for ADC and Gateway products, including certain FIPS and NDcPP variants. The vulnerability is classified under CWE-342, indicating issues with predictable values that may weaken security mechanisms.

Denial of service via malformed HTTP/2 requests in NetScaler ADC and NetScaler Gateway if HTTP/2 is enabled in HTTP Profile and associated with the virtual server (of type LB, CS, VPN) or the service configured on NetScaler