CVE-2026-8655

Multiple Memory overflow vulnerabilities leading to unpredictable or erroneous behavior and Denial of Service

No known exploitation. EPSS puts it in the 50th percentile. Fixed versions are out.

CVSS 3.19.8Critical EPSS percentile50th0.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix4 products5 fixed builds listed below

Published 2026-06-30Updated 2026-07-01Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

NetScaler ADCAffected: ≥ 14.1, < 72.61Upgrade to: 72.61Affected: ≥ 13.1, < 63.18Upgrade to: 63.18Affected: ≥ 14.1 FIPS, < 72.61Upgrade to: 72.61Affected: ≥ 13.1 FIPS and NDcPP, < 37.272Upgrade to: 37.272Stated by: CVE record
NetScaler GatewayAffected: ≥ 14.1, < 72.61Upgrade to: 72.61Affected: ≥ 13.1, < 63.18Upgrade to: 63.18Stated by: CVE record
Citrix Netscaler Application Delivery ControllerAffected: < 13.1-37.272Upgrade to: 13.1-37.272Stated by: NVD
Citrix Netscaler GatewayAffected: ≥ 13.1, < 13.1-63.18Upgrade to: 13.1-63.18Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your deployment is NetScaler ADC or NetScaler Gateway, and confirm if it is configured as an Oracle load balancer, a DNS Proxy, or a DNS recursive resolver.
Check your current NetScaler software version (Administration UI or system/version page).
Upgrade to a fixed version: for ADC or Gateway, move to 72.61 (or 63.18 / 37.272 as applicable), and for the corresponding ADC/Gateway branches ensure your target line matches the vendor’s fixed versions.
If you cannot upgrade right away, reduce exposure by disabling the affected roles/features that match your configuration (Oracle LB, DNS Proxy, or DNS recursive resolver) until patched.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

2 publishers

Vendor patch released
as reported · Jul 1, 2026·SecurityWeek summary

Sourced from public security reporting — each date is when it was published, not when it happened.

What it is

From the CVE record

Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if NetScaler ADC is configured as an LB of type Oracle OR NetScaler ADC is configured as a DNS Proxy OR NetScaler ADC is configured as a DNS recursive resolver deployment

In plain language

Written by AI from the record

CVE-2026-8655 is a NetScaler ADC/Gateway bug that an outsider can trigger over the network to crash the service or make it behave unpredictably; you should update if you run NetScaler as an Oracle load balancer or DNS proxy/recursive resolver.

CVE-2026-8655 is a set of unauthenticated, network-triggerable memory overflow flaws (CWE-119) in netscaler application delivery controller and netscaler gateway; exploitation causes unpredictable/erroneous behavior or Denial of Service when NetScaler ADC is configured as an Oracle LB, DNS Proxy, or DNS recursive resolver.

If you're affected

Service outages for customer traffic
Unreliable DNS resolution
Gateway/LB instability
Potential disruption of business operations

What is it

This vulnerability is like a weakness in NetScaler’s “core memory handling” that can be triggered from the network. Depending on how you’ve set up NetScaler (especially for DNS proxy/recursive DNS or Oracle load balancing), it can cause the service to crash or start behaving incorrectly, which can break access to your applications or name resolution for your customers.

Who is affected

This matters if you run netscaler application delivery controller or netscaler gateway and you use it in one of these ways: as an Oracle load balancer, a DNS Proxy, or a DNS recursive resolver. Because the trigger does not require authentication or user interaction, exposure depends mainly on whether your NetScaler is reachable and providing those network services.

Only consider it a direct risk if your NetScaler is reachable over the network in those roles (Oracle LB / DNS proxy / DNS recursive resolver).

How urgent is it

Treat this as a medium-high priority: it can be triggered remotely over the network and can lead to Denial of Service or erratic behavior, which can disrupt customer traffic. While the provided information does not show confirmed exploitation in the wild, the vulnerability is critical in severity and the fix is available.

If you use the affected roles (Oracle LB or DNS proxy/recursive resolver), prioritize patching on your next maintenance window or sooner.

What to do — in detail

Confirm exposure conditions

Determine whether the device is netscaler application delivery controller (ADC) or netscaler gateway.
Verify your configuration role:
- Oracle load balancer, OR
- DNS Proxy, OR
- DNS recursive resolver.
Check whether the service is reachable from external networks (for example, Internet-facing VIPs/IPs that serve those functions).

Identify your current software version

Record the exact NetScaler ADC/Gateway version currently installed.
Compare it to the vendor “fixed in” versions listed for your product.

Upgrade to the fixed release

ADC fixed in 72.61, 63.18, and 37.272 (choose the upgrade path that matches your branch/support requirements).
Gateway fixed in 72.61 and 63.18.
Follow the vendor remediation steps referenced by CTX696604 to perform the upgrade safely (including any pre-upgrade checks and rollback planning).

If you cannot patch immediately (temporary mitigation)

Disable or remove the relevant affected roles/features temporarily:
- Stop using the NetScaler ADC as an Oracle load balancer, and/or
- Disable DNS Proxy and/or DNS recursive resolver functions.
Route traffic for those functions to an alternative resolver/load balancing path until upgrades complete.

What to monitor after change

Service health of the ADC/Gateway (stability, crashes, restarts).
DNS behavior (resolution success/error rates) if you provide DNS services.
Load balancer behavior for Oracle backends (timeouts, failed connections, abnormal error rates).

KEV / exploitation monitoring note

No KEV listing was provided, and the press articles in the provided material did not report exploitation in the wild; still, monitor vendor advisories and your own logs for service instability while you prepare the upgrade.

CISA due date

Not provided in the supplied findings.

Technical context

Severity is listed as critical (CVSS 9.8). The weakness is memory overflow (CWE-119), which can corrupt process memory and lead to unpredictable/erroneous behavior or Denial of Service. The attack vector is network-based with no authentication and no user interaction.

Impact conditions from the findings: exploitation risk is tied to how NetScaler ADC is deployed—specifically when configured as an Oracle load balancer, as a DNS Proxy, or as a DNS recursive resolver deployment.

Exploitation status: no KEV listing, no public exploit code on record, and no clear dated press claim of exploitation were provided in the findings. Therefore, treat this as urgent from an availability-risk standpoint, not because confirmed active exploitation was shown in the supplied sources.

Patching: vendor-fixed versions are available for netscaler application delivery controller (fixed in 72.61 / 63.18 / 37.272) and netscaler gateway (fixed in 72.61 / 63.18), with remediation guidance referenced as CTX696604.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS50th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 50th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 15 days, from the signal feeds we watch.

2026-07-15OpenVAS check added
2026-07-01Patch availablerecord updated
2026-06-30Publishedweakness classified, att&ck mapped

Affected products

NetScalercommercial · USaka citrix, application delivery controller firmware, netscaler gateway firmware, xenserver
- ADCOn-premNetworking Infrastructure / load-balancer-proxy
- GatewayOn-premNetworking Infrastructure / load-balancer-proxy
- netscaler application delivery controllerNetwork DeviceOn-premNetworking Infrastructure / load-balancer-proxy
- netscaler gatewaySecurity ProductOn-premNetworking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable