Arbitrary file read (Unauthenticated) in Citrix ADC
Priority LOW 32CWE-73Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Arbitrary File Read (Unauthenticated) in NetScaler ADC and NetScaler Gateway if the access to NSIP, Cluster Management IP or SNIP with management access is enabled
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00578 47th percentileScored 2026-11-07
Fix Fixed ADC (NetScaler): 72.61, 63.18, 37.272Gateway (NetScaler): 72.61, 63.18
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Citrix | ADC | 14.1 to before 72.61; 13.1 to before 63.18; 14.1 FIPS to before 72.61; 13.1 FIPS and NDcPP to before 37.272 | 72.61, 63.18, 37.272 | Patch available | CNA |
| Citrix | Gateway | 14.1 to before 72.61; 13.1 to before 63.18 | 72.61, 63.18 | Patch available | CNA |
- ADC VendorCitrix Affected 14.1 to before 72.61; 13.1 to before 63.18; 14.1 FIPS to before 72.61; 13.1 FIPS and NDcPP to before 37.272 Fixed in 72.61, 63.18, 37.272 Patch available CNA
- Gateway VendorCitrix Affected 14.1 to before 72.61; 13.1 to before 63.18 Fixed in 72.61, 63.18 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:* | before 13.1-37.272 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:* | before 13.1-37.272 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:* | 13.1 to before 13.1-63.18; 14.1 to before 14.1-72.61 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:netscaler_application_delivery_controller:14.1-66.68:*:*:*:fips:*:*:* | 14.1-66.68 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:* | 13.1 to before 13.1-63.18; 14.1 to before 14.1-72.61 | Vulnerable | Citrix |
- cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:* Versions before 13.1-37.272 Vulnerable ·Citrix
- cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:* Versions before 13.1-37.272 Vulnerable ·Citrix
- cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:* Versions 13.1 to before 13.1-63.18; 14.1 to before 14.1-72.61 Vulnerable ·Citrix
- cpe:2.3:a:citrix:netscaler_application_delivery_controller:14.1-66.68:*:*:*:fips:*:*:* Versions 14.1-66.68 Vulnerable ·Citrix
- cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:* Versions 13.1 to before 13.1-63.18; 14.1 to before 14.1-72.61 Vulnerable ·Citrix
Remediation
- Fix · CNA ADC (NetScaler) Fixed in 72.61, 63.18, 37.272
- Fix · CNA Gateway (NetScaler) Fixed in 72.61, 63.18
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
NetScaler ADC, Gateway 37.272, 63.18, 72.61
6 records Highest priority Priority CRITICAL 1 CRITICAL, 3 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-07427 Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of ServicePriority CRITICAL 95
- TI-2026-07426 Insufficient input validation leading to memory overreadPriority MEDIUM 61
- TI-2026-07604 Multiple Memory overflow vulnerabilities leading to unpredictable or erroneous behavior and Denial of ServicePriority MEDIUM 45
Timeline
- 2026-10-02 Threatist record created from CVE-2026-10816
- 2026-10-03 Alias added: GHSA-jxcr-w9q6-gmhx
References
More Citrix Netscaler Application Delivery Controller vulnerabilities
- TI-2026-60195 Memory overflow vulnerability leading to Remote Code Execution or Denial of Service KEVCVSS 4.0CRITICAL 9.5
- TI-2026-60194 Improper input validation in Citrix ADC KEVCVSS 4.0CRITICAL 9.5
- TI-2023-04571 Unauthenticated sensitive information disclosure in Citrix NetScaler ADC KEVCVSS 3.1CRITICAL 9.4
- TI-2023-03284 Unauthenticated remote code execution in Citrix NetScaler ADC KEVCVSS 3.1CRITICAL 9.8
- TI-2026-15872 NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490 KEVCVSS 4.0CRITICAL 9.3
- TI-2026-02639 Insufficient input validation leading to memory overread KEVCVSS 4.0CRITICAL 9.3
Sources
- CVE-2026-10816 · CVE Program
- CVE-2026-10816 · NVD
- FIRST EPSS
- GHSA-jxcr-w9q6-gmhx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences