This text was generated using artificial intelligence (AI).Update November 13, 2026: Additionally, CVE-2026-107415 (CVSS 9.3) has been disclosed. The vulnerability affects email OTP authentication in NetScaler ADC and Gateway. Details see below.
Citrix published advisory CTX697305 on November 12, 2026, regarding critical vulnerabilities in Citrix NetScaler ADC and Citrix NetScaler Gateway. The vulnerabilities in the advisory receive CVSS scores of up to 9,5.
The included vulnerabilities are CVE-2026-107410 and CVE-2026-107409, each with a CVSS score of 9,3, as well as CVE-2026-107415 (CVSS 9,3). Critical for prioritization are the activated NetScaler features and the external accessibility of the respective appliance.
Advisory CTX697305 addresses buffer overflows and memory corruption in various operating modes of Citrix NetScaler. In addition to the vulnerabilities listed below, the advisory includes further entries regarding Gateway and SMPP configurations.
Vulnerability
Affected configuration
Documented impact
CVE-2026-107410
Load-Balancing Virtual Server of type PUSH
A buffer overflow in NetScaler Push can lead to unpredictable or erroneous behavior as well as denial of service.
CVE-2026-107409
DNS Load Balancing over HTTPS
A memory corruption in DNS-over-HTTPS can lead to unpredictable or erroneous behavior as well as denial of service.
CVE-2026-107415
Email OTP Authentication
A buffer overflow in the Email OTP Authentication can lead to unpredictable or erroneous behavior as well as denial of service.
Check Gateway and AAA Roles First
The advisory also includes vulnerabilities in NetScaler instances configured as Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy) or as AAA virtual servers. No authentication is documented as a prerequisite for these configurations. Internet-facing Gateway and AAA appliances therefore have a high priority in the impact assessment.
According to CERT-EU Security Advisory 2026-020, it is recommended to patch internet-facing Gateway and AAA appliances first. For the other vulnerabilities in the advisory, it should also be checked whether SMPP, PUSH, DoH, or Email OTP configurations are active. An assessment based solely on the product name is not sufficient because the respective vulnerabilities are tied to specific operational roles.
As of the current status of the advisory, there is no evidence of active exploitation of the described vulnerabilities.
CVE-2026-107415: Buffer Overflow in Email OTP Authentication
CVE-2026-107415 affects NetScaler instances that use Email OTP Authentication. The vulnerability has a CVSS score of 9,3 (critical) and can be exploited over the network without authentication.
A buffer overflow in the Email OTP Authentication can lead to unpredictable or erroneous behavior as well as denial of service. Affected are Citrix NetScaler ADC and Citrix NetScaler Gateway in versions 14.1 before 14.1-73.57, 13.1 before 13.1-64.39 as well as the FIPS variants 14.1-FIPS before 14.1-73.58 FIPS and 13.1-FIPS/NDcPP before 13.1-37.293.
The vulnerability is fixed by the target versions mentioned in the advisory. Organizations using Email OTP Authentication in NetScaler should prioritize the update.
Affected Product Variants and Fixes
Affected are Citrix NetScaler ADC, Citrix NetScaler Gateway, and Citrix NetScaler ADC FIPS in specific releases.
Standard Variants
For Citrix NetScaler ADC and Citrix NetScaler Gateway, the following fixes apply:
Version 14.1 before 14.1-73.57: Update to 14.1-73.57 or higher
Version 13.1 before 13.1-64.39: Update to 13.1-64.39 or higher
FIPS Variants
For Citrix NetScaler ADC FIPS, there are specific target versions:
Version 14.1-FIPS before 14.1-73.58 FIPS: Update to 14.1-73.58 FIPS or higher
Version 13.1-FIPS/NDcPP before 13.1-37.293: Update to 13.1-37.293 or higher
Prioritized Actions
Check internet-facing gateway and AAA appliances for product variant, patch level, and active roles.
Update NetScaler ADC and Citrix Gateway of the standard variants to the designated fixed releases.
Record FIPS and FIPS/NDcPP instances separately and update according to their respective target versions.
Identify SMPP, PUSH, DoH, and email OTP virtual servers in the NetScaler configuration.
Permanently integrate vulnerability and supplier monitoring into the update process.
If an update cannot be carried out immediately, the external accessibility of the affected services should be checked until the maintenance window. The provided patches remain the intended measures for the affected product versions.
NIS-2 obligated organizations in Germany and Austria, as well as ISG obligated operators in Switzerland, should check whether the affected NetScaler appliances fall under their respective reporting obligations. The BSI generally recommends prioritizing patching critical network components such as remote access gateways.
What LocateRisk Supports in Classification
Citrix NetScaler ADC and NetScaler Gateway can be operated under customer domains and identified through external characteristics such as banners, TLS certificates, or HTTP responses. LocateRisk helps to make publicly accessible NetScaler instances in the infrastructure visible and to classify them for patch prioritization.
The platform can make the deployed software and its external accessibility visible. Whether a specific instance is using a vulnerable version requires a comparison with the patch level and the respective product variant.
For supplier risks, Cyber Vendor Risk Management (C-VRM) complements the technical perspective: critical security alerts from manufacturers and changes in their security level can be assessed in the context of existing dependencies.
Am I affected?
This affects Citrix NetScaler ADC, Citrix Gateway, and Citrix NetScaler ADC FIPS in the versions mentioned above; the respective fixed releases are listed in the table above. Those who want to know whether Citrix NetScaler ADC, Citrix Gateway, and Citrix NetScaler ADC FIPS are visible in their externally accessible infrastructure can check the CVE Quick Check Use the tool at the end of this article: It shows exposed systems and the software that is visible from the outside.
It is not always possible to determine the specific version that has been installed from the outside—the key factor is comparing it with the manufacturer's advisory.
This affects Citrix NetScaler ADC and Citrix NetScaler Gateway in the version branches 14.1 prior to 14.1-73.57 and 13.1 prior to 13.1-64.39. For FIPS variants, 14.1-FIPS prior to 14.1-73.58 FIPS and 13.1-FIPS/NDcPP prior to 13.1-37.293 apply as version limits.
Yes. The target versions mentioned in the advisory CTX697305 close all addressed vulnerabilities at the same time. A separate patch for each vulnerability is not required.
According to the current status of Citrix Advisory CTX697305, there are no indications of active exploitation of the described vulnerabilities.
Status: November 13, 2026. This contribution serves general informational purposes and is not legal, security, or individual advisory. The security situation and patch availability may have changed since publication; the linked manufacturer advisory is always decisive. Despite careful research, we do not guarantee the timeliness, correctness, and completeness.
CVE Quick Check
In just a few minutes, check whether there are any indications of a current CVE on your externally visible attack surface.
Initial assessment in just a few minutes via email.
Learn more during a free consultation with a LocateRisk consultant.
You'll receive this by email
companyYour Company, LLC
Verified CVECVE-2026-107412
Passive Assessment
Information About the CVEfound or not found
Want to find out more, book a demo or simply exchange ideas? We look forward to hearing from you!
We use cookies to optimize our website and our service.
Functional
Always active
Technical storage or access is strictly necessary for the lawful purpose of enabling the use of a particular service expressly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a message over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that have not been requested by the subscriber or user.
Statistics
The technical storage or access, which is carried out exclusively for statistical purposes.Technical storage or access used solely for anonymous statistical purposes. Without a subpoena, the voluntary consent of your Internet service provider, or additional records from third parties, information stored or accessed for this purpose alone generally cannot be used to identify you.
Marketing
Technical storage or access is necessary to create user profiles, to send advertisements, or to track the user on a website or across multiple websites for similar marketing purposes.
English 
Deutsch 
Français