CVE-2026-10816

No known exploitation. EPSS puts it in the 47th percentile. Fixed versions are out.

CVSS 3.17.5High EPSS percentile47th0.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix4 products5 fixed builds listed below

Published 2026-06-30Updated 2026-07-02Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

NetScaler ADCAffected: ≥ 14.1, < 72.61Upgrade to: 72.61Affected: ≥ 13.1, < 63.18Upgrade to: 63.18Affected: ≥ 14.1 FIPS, < 72.61Upgrade to: 72.61Affected: ≥ 13.1 FIPS and NDcPP, < 37.272Upgrade to: 37.272Stated by: CVE record
NetScaler GatewayAffected: ≥ 14.1, < 72.61Upgrade to: 72.61Affected: ≥ 13.1, < 63.18Upgrade to: 63.18Stated by: CVE record
Citrix Netscaler Application Delivery ControllerAffected: < 13.1-37.272Upgrade to: 13.1-37.272Stated by: NVD
Citrix Netscaler GatewayAffected: ≥ 13.1, < 13.1-63.18Upgrade to: 13.1-63.18Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether you expose NetScaler ADC/Gateway management interfaces externally (NSIP, Cluster Management IP, and SNIP with management access enabled).
If any are reachable from untrusted networks, prioritize upgrading NetScaler ADC/Gateway to the fixed releases: 72.61, 63.18, or 37.272.
After upgrading, confirm the management interfaces are still configured as intended and restricted (limit access to approved admin networks only).

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

2 publishers

Vendor patch released
as reported · Jul 1, 2026·SecurityWeek summary

Sourced from public security reporting — each date is when it was published, not when it happened.

What it is

From the CVE record

Arbitrary File Read (Unauthenticated) in NetScaler ADC and NetScaler Gateway if the access to NSIP, Cluster Management IP or SNIP with management access is enabled

In plain language

Written by AI from the record

CVE-2026-10816 is an unauthenticated weakness in ADC/Gateway that could let someone read sensitive system files, so you should update if your management interfaces (NSIP, Cluster Management IP, or SNIP with management access) are reachable.

Unauthenticated arbitrary file read (CWE-73) in NetScaler ADC and NetScaler Gateway via management interface access; an attacker can read files without needing an account, provided they can reach NSIP/Cluster Management IP or a management-enabled SNIP.

If you're affected

Sensitive configuration disclosure
Credential and key exposure risk
Operational disruption
Further targeted attacks enabled

What is it

This vulnerability is like leaving a closet door unlocked: without logging in, an attacker who can reach the right “admin entry points” may be able to open and view arbitrary files on the device. Those files can include configuration details and other sensitive information that help attackers plan the next step.

Who is affected

This matters if you run NetScaler ADC or NetScaler Gateway and you have management access enabled on NSIP, Cluster Management IP, or an SNIP that has management access turned on. The risk is specifically tied to reachability: it’s only a concern if an attacker can reach those management interfaces from their side (for example, from the internet or an untrusted network).

How urgent is it

This is a GREEN issue: there is no CISA KEV entry and no confirmed, dated public exploitation claim in the provided findings. Still, because it allows unauthenticated reading of arbitrary files, you should update promptly if your management interfaces are reachable as described.

What to do — in detail

Confirm exposure (most important)
- Identify the configured addresses for: NSIP, Cluster Management IP, and SNIP(s).
- Verify whether SNIP management access is enabled for any SNIP.
- Check network controls (firewalls/security groups) to determine whether those management addresses are reachable from untrusted networks (especially the public internet).
Confirm your current NetScaler version
- Record the exact ADC/Gateway version currently deployed.
Upgrade to a fixed release
- NetScaler ADC: fixed in 72.61, 63.18, or 37.272.
- NetScaler Gateway: fixed in 72.61, 63.18, or 37.272.
- Choose the fixed version that matches your supported upgrade path.
Validate after upgrading
- Re-check that the management interfaces are still restricted to approved administrator networks.
- Ensure no unexpected SNIP management access is enabled.
If you cannot upgrade immediately
- Restrict network access so that NSIP / Cluster Management IP / any management-enabled SNIP are not reachable from untrusted networks. The findings indicate the vulnerability depends on “management access is enabled” and practical reachability of those interfaces, so tightening access is the key temporary control.
What to monitor
- Monitor for repeated connection attempts to the management interfaces from unexpected source networks.
- Review device logs for unusual access patterns around management ports.

CISA due date:

Not provided (not listed in KEV in the provided findings).

Technical context

Severity/impact: Arbitrary File Read (CWE-73) in NetScaler ADC and NetScaler Gateway can allow unauthenticated users to read files on the underlying system. The practical risk hinges on reachability to management endpoints.

Mechanism and triggering conditions: The findings state that an unauthenticated attacker can read arbitrary files without user interaction. Preconditions include access to NSIP, Cluster Management IP, or SNIP with management access enabled.

Exploitation status: Not listed in CISA KEV, and the provided news/exploit findings do not show a clear dated real-world exploitation claim or public exploit code.

Patch status: Fixed versions are provided for both ADC and Gateway: 72.61, 63.18, 37.272.

EPSS: A prediction is present in the findings (0.2% with a flat trend), but since KEV is not listed and exploitation is not confirmed in the provided sources, no exploitation certainty is implied.

Exploit maturity: Based on the findings, exploit maturity is not demonstrated by public exploit availability or confirmed press reporting in the provided materials.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS47th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 47th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

5 events over 15 days, from the signal feeds we watch.

2026-07-15OpenVAS check added
2026-07-02Patch availablerecord updated
2026-06-30Publishedweakness classified

Affected products

NetScalercommercial · USaka citrix, application delivery controller firmware, netscaler gateway firmware, xenserver
- netscaler application delivery controllerNetwork DeviceOn-premNetworking Infrastructure / load-balancer-proxy
- netscaler gatewaySecurity ProductOn-premNetworking Infrastructure
- ADCOn-premNetworking Infrastructure / load-balancer-proxy
- GatewayOn-premNetworking Infrastructure / load-balancer-proxy

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact

Weaknesses

Sources

References in the record

support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604

In the news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Citrix, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account