Citrix Patches Six NetScaler Vulnerabilities

On Tuesday, July 2026, Citrix issued a bulletin with patches for six NetScaler ADC and Gateway flaws that enable memory overread, arbitrary file read, or denial-of-service. A manual `Http2SmallWndTimeout` change to 30 seconds is required for appliances without HTTP Strict Profiles.

Citrix Patches Six NetScaler Flaws Allowing File Read and Denial-of-Service

CVE-2026-8451 shares a root cause with the earlier CVE-2026-3055 (CVSS 9.3), a “CitrixBleed” memory overread that entered CISA’s KEV catalog after rapid exploitation. NetScaler has appeared in over 20 KEV entries in three years, indicating recurring memory-management weaknesses.

Cyberscoop

The six CVEs receive CVSS scores from 6.9 to 8.8. CVE-2026-8451 can leak a few bytes; two others may cause memory overflow and DoS. One flaw permits unauthenticated file reads when management interfaces are exposed.

Cyberscoop

Citrix’s bulletin states that the updates address multiple flaws that could be exploited to facilitate arbitrary file reads or trigger a denial-of-service condition. CISA notes that, unlike CVE-2026-3055, there is “no evidence that the issues have been exploited in the wild” for the newly disclosed vulnerabilities.

Cyberscoop

watchTowr researcher Aliz Hammond warns that the recurring memory-overread bugs “suggest memory management continues to appear fragile within Citrix NetScaler appliances, to the extent that even accidentally misconfiguring an appliance can lead to the disclosure of leaked memory.”

Cyberscoop

Unpatched appliances could let attackers read memory, retrieve files, or launch DoS attacks—capabilities used in ransomware. The required manual `Http2SmallWndTimeout` change adds operational complexity, raising the risk of incomplete mitigation.

Citrix Patches Six NetScaler Flaws Allowing File Read and Denial-of-Service

All sources agree no exploitation of CVE-2026-8451 has been observed, but the swift abuse of CVE-2026-3055 creates uncertainty about future attacks. Exploit details for the other five CVEs remain undisclosed.

Citrix Patches Six NetScaler Flaws Allowing File Read and Denial-of-Service

• “Citrix on Tuesday released security updates to address multiple flaws in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) that could be exploited by an attacker to facilitate arbitrary file reads or trigger a denial-of-service (DoS) condition.” — Citrix, Security Bulletin

Citrix Patches Six NetScaler Flaws Allowing File Read and Denial-of-Service

• “One thing we're keen to note: in contrast to the original CVE-2026-3055, in which kilobytes of binary data can be leaked, this overread will terminate the out-of-bounds read when various control characters are read, such as NULL (or even >),” — Aliz Hammond, watchTowr researcher

Citrix Patches Six NetScaler Flaws Allowing File Read and Denial-of-Service

• “In practice, we found that by varying the request length, we could consistently squeeze a few bytes out of the server.” — Aliz Hammond, watchTowr researcher

Citrix Patches Six NetScaler Flaws Allowing File Read and Denial-of-Service

• “The sixth involves a denial-of-service condition tied to malformed HTTP/2 requests, which requires an additional manual configuration change to fully fix, since the relevant timeout parameter defaults to a value that leaves the underlying condition unaddressed unless administrators set it explicitly.” — Cyberscoop editorial staff

Cyberscoop

Organizations should apply the patches, set `Http2SmallWndTimeout` to 30 seconds where required, and monitor Citrix and CISA advisories for any signs of active exploitation.

Citrix Patches Six NetScaler Flaws Allowing File Read and Denial-of-Service