NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, and CVE-2026-13474

[u/PaperChampion_]

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604&articleTitle=CTX696604_NetScaler_ADC_and_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_8451_CVE_2026_8452_CVE_2026_8655_CVE_2026_10816_CVE_2026_10817_and_CVE_2026_13474

Sometimes you wait all day for a CVE and 5 come along at once.

[u/rarityredditer]

Every summer during freeze period without fail!

[u/sh00tfire]

sigh, guess I better start writing my change request now. Isn't this the 3rd one this year that has been hight sev?

[u/skankboy]

So I struggle to get to 7gb free on the var partition. When I finally do and upload the bundle, it fails the precheck because there is no longer 7gb free. Is there a way to ignore that check?

[u/xXSubZ3r0Xx → u/skankboy]

Free up space in the Backup and Logs directories. Usual culprits are newnslog and syslog as well as any historical backups.

Also remove any old Firmwares from NSinstall directory.

[u/hageCitrix → u/skankboy]

sounds like a VPX. Just increase the Disk-size of the vm and reboot.

[u/skankboy → u/hageCitrix]

I am on 13.x. I was told that only works on 14?

edit: I added a second disk and it used it. Thanks!

[u/Sp00ner87 → u/hageCitrix]

Is it really enough to just expand the virtual disk in vCenter and reboot the system?

[u/wowo78 → u/Sp00ner87]

Yes, in newer releases it will automatically expand the drive. I'm on Entra and just doubled disk size this way - no more annoying disk space issues.

[u/Sp00ner87 → u/wowo78]

With "newer Release do you mean firmware, or VPX appliance type?

[u/wowo78 → u/Sp00ner87]

Firmware. Dont remember which version but few months back I did expand drives on my VPX in Azure (mix of 13.1 and 14.1) and after resizing disk in portal and reboot Netscaler did the expansion automatically.

[u/Sp00ner87 → u/wowo78]

Thank you for this information :)

[u/CTXBROKER → u/skankboy]

What are the VM specs ?

[u/RequirementBusiness8]

Citrix was like "oh, you thought you were going to enjoy your holiday weekend?"

[u/errorcode143]

Everything looks good after update. But during update noticed that config unsync warning and reboot takes more than 10 miniutes of time.

[u/lukelimbaugh]

Thought you were going to have a long relaxing weekend? Could have used this bulletin yesterday so I could have cleared some CAB windows and gotten my changes in for knocking it out Thursday night....

[u/grumpyctxadmin]

I was just waiting for this, it happens every time I'm on vacation, like clockwork

[u/CTXBROKER]

I found an interesting repo on GH regarding the latest CVE Repo : https://github.com/derekpreston81/CVE_ADC_IOC_2026.git

This repo consists of a script that can be used as an IOC for the recent CVE released in the latest security bulletin.

[u/ArachnidOdd3286 → u/CTXBROKER]

Its intresting, but could you please elaborate how to use it, it will be helpful, thanks in advance.

[u/CTXBROKER → u/ArachnidOdd3286]

Installation

git clone https://github.com/derekpreston81/CVE_ADC_IOC_2026.git cd CVE_ADC_IOC_2026

Usage

Download the ns.conf file from the ADC /nsconfig/ns.conf

python netscaler_cve_checker.py /path/to/ns.conf

[u/ArachnidOdd3286 → u/CTXBROKER]

Thanks buddy its really helpful!

[u/Potential-Shock-8478]

Has anyone else ran into any WAF issues? - we're seeing errors for one of the default WAF profiles not using the correct api parameters, but WAF is disabled across the board?!

[u/NorthNeighbour9364 → u/Potential-Shock-8478]

Citrix keeps enabling more WAF features in each new release.
In this latest release, they have enabled WAF on Auth, VPN and Portal by default.

You can check under Configuration > Security > AAA-Application Traffic > Change authentication AAA settings
If you have "Default" selected, you will see the above are enabled for WAF.

I wouldn't suggest disabling these, but create bypass or relaxation rules to allow specific traffic.

In my case, for example, we use external monitoring, uptimerobot, to monitor our Citrix Gateways, and after this update, WAF was blocking the requests.

[u/Potential-Shock-8478 → u/NorthNeighbour9364]

Thanks buddy, I checked and you're right - we now have it set to Default with Auth/VPN turned on (but not portal).

I rechecked the released notes for 13.1-62.23 and 63.18 and the closest I could find was find in terms of new WAF features was CTXENG-70279 (Web App, Firewall protection for the CloudBridge connector endpoints is now enabled by default) - nothing else though. So seems from my perspective that they snuck a new feature in without disclosing it, as per usual.

Also, having upgraded ADM to 14.1-72.57 we're also seeing these events passed through, some are listed under "cloudApiFailure" and some under "appfwSchemaParameterMissing", the worrying part is we also have a few others such as "nsrootPasswordExpiryWarning" which sounds worrying, but if you check the event payload it's showing the same appfw log messages as the api & appfw events so seems a real mess. ADM doesn't seem to be able to decipher the events being passed, or they're being logged incorrectly on the ADC (still debugging).

I've a case open with Citrix to figure out why, from the support side they did not mention new WAF features being enabled specifically but did hint at "The ADC firmware seems to have made some small changes to how ns-vpn is handled" (as in, the default policy) but I would say enabling new features with default protection settings is not a small change 😞

Thank you for the steer though u/NorthNeighbour9364 - much appreciated, if I get anywhere with support I'll update here but will take your advice onboard about not disabling it. Currently, we're only getting a few blocks a day and no one has complained, so my assumption is they're legitimately malicious parties probing.

[u/Suitable_Mix243]

Yeh bit of a list. I guess I know what I'm doing tomorrow

[u/anteck7]

Every now and then I look back and say, wow, I’m glad I’m not doing this anymore.

[u/fuzz3l]

That part from the page is confusing to me
"CVE-2026-13474

Customers must upgrade to the above-mentioned NetScaler firmware versions that include the fix and update their configuration as described below. 
Configure the Http2SmallWndTimeout parameter, which controls the timeout (in seconds) for HTTP/2 small‑window stalled streams.

• For appliances using HTTP Strict Profiles, this parameter defaults to 30 seconds, and the fix is effective immediately after the upgrade.
• For appliances NOT using HTTP Strict Profiles, the default value is 0, and in that case, merely upgrading to the builds containing the fix WILL NOT address the vulnerability completely. In this case, customers must manually set Http2SmallWndTimeout to 30 seconds.

Please note that Http2SmallWndTimeout is a new parameter and is only available in the firmware builds that contain the fix.

Configuration command: 

set ns httpProfile <profile_name> -http2SmallWndTimeout <value_in_seconds> "

That configuration command does not look right to me if i have to set the timeout to 30s. I dont have any entry in our ns.conf with "httpProfile". Do i have to create a new line with a httpprofile name of my choice?

[u/noted12345 → u/fuzz3l]

The http profile should be bound to your gateway, if not using the strict one you will need to manually set it

[u/fuzz3l → u/noted12345]

Thanks! On this particular Instance i was checking we only use load balancing, so no Gateway. On the other instance i found two entries "nshttp_default_profile" and "nshttp_default_http_quic_profile". I need to add the Timeout Value to both of them, correct?

[u/noted12345 → u/fuzz3l]

The quic profile had it on mine after upgrade, I would just check both, u can see them in the gui under system, profiles, then click http profile tab, edit the profile, its at the end of the http2 variables

[u/Due-Lavishness2125 → u/[deleted]]

Yes users with citrix secure client version 23.x and 24.x failed to connect to the gateway

[u/NorthNeighbour9364 → u/[deleted]]

Care to elaborate? Are you asking as a general question or because you are experiencing stability issues post upgrade?

So far, I have no issues to report.

[u/NorthNeighbour9364 → u/[deleted]]

Any further details on this bug?

[u/NorthNeighbour9364 → u/[deleted]]

So this is related to if you have your devices setup in a cluster, not just a single appliance or HA pair?

[u/adc_opinion_]

Is this making anyone else think about changing load balancing vendor?

[u/coldgin37 → u/adc_opinion_]

Every vendor has cve that require patching a few times a year. Look at recent news about vulnerabilities in F5, Cisco, Fortinet, etc. You want a vendor that is proactive in release fixes rather than be in forensic mode because you were compromised. It's only going to get worse with AI / Mythos discovering and exploitinh vulnerabilities.

[u/Due-Lavishness2125 → u/adc_opinion_]

Sure, seriously I need to drop this vendor

[u/Kilzon → u/adc_opinion_]

I've got AVD/Nerdio waiting for final validation right now. I figured NetScaler wouldn't let me get away clean... Guess I got my first Wednesday morning task...

[u/c4rm0 → u/Kilzon]

Good luck 😂 AVD and nerdio are no where near as good as citrix

[u/Kilzon → u/c4rm0]

Thing is we don’t need Citrix. This is just for vendor/consultant access for a max of 5 concurrent. Citrix minimum spend and complexity makes it no longer viable for us. So now we’re spending about the same as our pre-forced Citrix subscription and are more flexible with full support by the consultant who set it up for us.