Memory corruption in Citrix NetScaler ADC
Priority MEDIUM 43CWE-119Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- Low · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Memory safety vulnerability leading to memory corruption and Denial of Service in NetScaler ADC and Gateway if the appliance must be configured as a Gateway (VPN Vserver) with RDP Feature enabled OR the appliance must be configured as a Gateway (VPN Vserver) and RDP Proxy Server Profile is created and set to Gateway (VPN Vserver) OR the appliance must be configured as a Auth Server (AAA Vserver) with RDP Feature enabled
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00559 46th percentileScored 2026-11-07
Fix Fixed NetScaler ADC (NetSclaer): 29.72, 55.34, 37.207 +1NetScaler Gateway (NetScaler): 29.72, 55.34, 37.207 +1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Citrix | NetScaler ADC | 14.1 to before 29.72; 13.1 to before 55.34; 13.1-FIPS to before 37.207; 12.1-FIPS to before 55.321; 12.1-NDcPP to before 55.321 | 29.72, 55.34, 37.207, 55.321 | Patch available | CNA |
| Citrix | NetScaler Gateway | 14.1 to before 29.72; 13.1 to before 55.34; 13.1-FIPS to before 37.207; 12.1-FIPS to before 55.321; 12.1-NDcPP to before 55.321 | 29.72, 55.34, 37.207, 55.321 | Patch available | CNA |
- NetScaler ADC VendorCitrix Affected 14.1 to before 29.72; 13.1 to before 55.34; 13.1-FIPS to before 37.207; 12.1-FIPS to before 55.321; 12.1-NDcPP to before 55.321 Fixed in 29.72, 55.34, 37.207, 55.321 Patch available CNA
- NetScaler Gateway VendorCitrix Affected 14.1 to before 29.72; 13.1 to before 55.34; 13.1-FIPS to before 37.207; 12.1-FIPS to before 55.321; 12.1-NDcPP to before 55.321 Fixed in 29.72, 55.34, 37.207, 55.321 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:* | 12.1 to before 12.1-55.321 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:* | 12.1 to before 12.1-55.321 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:* | 12.1 to before 13.1-55.34 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:* | 13.1 to before 13.1-37.207 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:* | 14.1 to before 14.1-29.72 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:* | 12.1 to before 13.1-55.34; 14.1 to before 14.1-29.72 | Vulnerable | Citrix |
- cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:* Versions 12.1 to before 12.1-55.321 Vulnerable ·Citrix
- cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:* Versions 12.1 to before 12.1-55.321 Vulnerable ·Citrix
- cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:* Versions 12.1 to before 13.1-55.34 Vulnerable ·Citrix
- cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:* Versions 13.1 to before 13.1-37.207 Vulnerable ·Citrix
- cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:* Versions 14.1 to before 14.1-29.72 Vulnerable ·Citrix
- cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:* Versions 12.1 to before 13.1-55.34; 14.1 to before 14.1-29.72 Vulnerable ·Citrix
Remediation
- Fix · CNA NetScaler ADC (NetSclaer) Fixed in 29.72, 55.34, 37.207, 55.321
- Fix · CNA NetScaler Gateway (NetScaler) Fixed in 29.72, 55.34, 37.207, 55.321
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
NetScaler Gateway 29.72, 37.207 and 2 more versions
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2024-07912 Authenticated user can access unintended user capabilitiesPriority LOW 28
Timeline
- 2026-10-02 Threatist record created from CVE-2024-8534
- 2026-10-03 Alias added: GHSA-33mv-fjxj-2mx6
References
More Citrix Netscaler Application Delivery Controller vulnerabilities
- TI-2026-60195 Memory overflow vulnerability leading to Remote Code Execution or Denial of Service KEVCVSS 4.0CRITICAL 9.5
- TI-2026-60194 Improper input validation in Citrix ADC KEVCVSS 4.0CRITICAL 9.5
- TI-2023-04571 Unauthenticated sensitive information disclosure in Citrix NetScaler ADC KEVCVSS 3.1CRITICAL 9.4
- TI-2023-03284 Unauthenticated remote code execution in Citrix NetScaler ADC KEVCVSS 3.1CRITICAL 9.8
- TI-2026-15872 NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490 KEVCVSS 4.0CRITICAL 9.3
- TI-2026-02639 Insufficient input validation leading to memory overread KEVCVSS 4.0CRITICAL 9.3
Sources
- CVE-2024-8534 · CVE Program
- CVE-2024-8534 · NVD
- FIRST EPSS
- GHSA-33mv-fjxj-2mx6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences