CVE-2026-8655

Multiple Memory overflow vulnerabilities leading to unpredictable or erroneous behavior and Denial of Service

En bref

Sévérité: HIGH 8.8
EPSS: EPSS 0.63 % · centile 50 (2026-10-27)
État: PUBLISHED
Publiée: 2026-06-30
Mise à jour: 2026-06-30
Attribuée par: NetScaler
Statut NVD: Analyzed

Description

Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if NetScaler ADC is configured as an LB of type Oracle OR NetScaler ADC is configured as a DNS Proxy OR NetScaler ADC is configured as a DNS recursive resolver deployment

Scores

Version	Score	Vecteur	Évalué par
CVSS 4.0	HIGH 8.8	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:L	NetScaler
CVSS 4.0	HIGH 8.8	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5 (Secondary)
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)

Faiblesses (CWE)

CWE-119

Références européennes

ENISA EUVD · EUVD-2026-40308
GCVE · GCVE-0-2026-8655

Avis du CERT-FR

CERTFR-2026-AVI-0822 — Multiples vulnérabilités dans les produits Citrix · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:* < 13.1-37.272
cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:* < 13.1-37.272
cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:* ≥ 13.1 < 13.1-63.18
cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:* ≥ 14.1 < 14.1-72.61
cpe:2.3:a:citrix:netscaler_application_delivery_controller:14.1-66.68:*:*:*:fips:*:*:*
cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:* ≥ 13.1 < 13.1-63.18
cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:* ≥ 14.1 < 14.1-72.61

Produits affectés

Produit	Versions
NetScaler · ADC	affected 14.1 < 72.61 ; affected 13.1 < 63.18 ; affected 14.1 FIPS < 72.61 ; affected 13.1 FIPS and NDcPP < 37.272
NetScaler · Gateway	affected 14.1 < 72.61 ; affected 13.1 < 63.18

Références

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD