CVE-2026-10817

Insufficient input validation leading to memory overread in NetScaler ADC and NetScaler Gateway if the TCP TimeStamp is enabled in TCP Profile and is associated with the virtual server (of type LB, CS, VPN) or the service configured on NetScaler

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::fips:::*
	cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::ndcpp:::*
	cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::-:::*
	cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::-:::*
	cpe:2.3:a:citrix:netscaler_application_delivery_controller:14.1-66.68::::fips:::
	cpe:2.3:a:citrix:netscaler_gateway::::::::
	cpe:2.3:a:citrix:netscaler_gateway::::::::

History

No history.

Information

Published : 2026-06-30 13:17

Updated : 2026-07-02 16:57

NVD link : CVE-2026-10817

Mitre link : CVE-2026-10817

CVE.ORG link : CVE-2026-10817

JSON object : View

Products Affected

citrix

netscaler_gateway
netscaler_application_delivery_controller

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2026-10817", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10817", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-30T13:28:08.900923Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "50a63c94-1ea7-4568-8c11-eb79e7c5a2b5", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "50a63c94-1ea7-4568-8c11-eb79e7c5a2b5", "affectedData": [{"vendor": "NetScaler", "product": "ADC", "versions": [{"status": "affected", "version": "14.1", "lessThan": "72.61", "versionType": "patch"}, {"status": "affected", "version": "13.1", "lessThan": "63.18", "versionType": "patch"}, {"status": "affected", "version": "14.1 FIPS", "lessThan": "72.61", "versionType": "patch"}, {"status": "affected", "version": "13.1 FIPS and NDcPP", "lessThan": "37.272", "versionType": "patch"}], "defaultStatus": "unaffected"}, {"vendor": "NetScaler", "product": "Gateway", "versions": [{"status": "affected", "version": "14.1", "lessThan": "72.61", "versionType": "patch"}, {"status": "affected", "version": "13.1", "lessThan": "63.18", "versionType": "patch"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-30T13:17:04.363", "references": [{"url": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604", "tags": ["Vendor Advisory"], "source": "50a63c94-1ea7-4568-8c11-eb79e7c5a2b5"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "50a63c94-1ea7-4568-8c11-eb79e7c5a2b5", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "Insufficient input validation leading to memory overread in\u00a0NetScaler ADC and NetScaler Gateway if the\u00a0TCP TimeStamp is enabled in TCP Profile and is associated with the virtual server (of type LB, CS, VPN) or the service configured on NetScaler"}], "lastModified": "2026-07-02T16:57:03.933", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*", "vulnerable": true, "matchCriteriaId": "D8189708-5190-45E3-BF9A-7A429E87DFE7", "versionEndExcluding": "13.1-37.272"}, {"criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*", "vulnerable": true, "matchCriteriaId": "D93A5760-5C50-4786-B981-24A7B35C3055", "versionEndExcluding": "13.1-37.272"}, {"criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "BC139A27-D7CE-4D92-9A1F-09713C4C9546", "versionEndExcluding": "13.1-63.18", "versionStartIncluding": "13.1"}, {"criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "0108075C-1047-449C-A707-F2532770C2AD", "versionEndExcluding": "14.1-72.61", "versionStartIncluding": "14.1"}, {"criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:14.1-66.68:*:*:*:fips:*:*:*", "vulnerable": true, "matchCriteriaId": "A2BC089B-97D0-4FDB-A336-74409DCDC5E3"}, {"criteria": "cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "962D2276-7285-41E2-A867-D464AE11677F", "versionEndExcluding": "13.1-63.18", "versionStartIncluding": "13.1"}, {"criteria": "cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1591FBCE-57DD-416F-A858-E898B0946AB6", "versionEndExcluding": "14.1-72.61", "versionStartIncluding": "14.1"}], "operator": "OR"}]}], "sourceIdentifier": "50a63c94-1ea7-4568-8c11-eb79e7c5a2b5"}