CVE-2026-8655

This vulnerability is like a weakness in NetScaler’s “core memory handling” that can be triggered from the network. Depending on how you’ve set up NetScaler (especially for DNS proxy/recursive DNS or Oracle load balancing), it can cause the service to crash or start behaving incorrectly, which can break access to your applications or name resolution for your customers.

This matters if you run netscaler application delivery controller or netscaler gateway and you use it in one of these ways: as an Oracle load balancer, a DNS Proxy, or a DNS recursive resolver. Because the trigger does not require authentication or user interaction, exposure depends mainly on whether your NetScaler is reachable and providing those network services.

Only consider it a direct risk if your NetScaler is reachable over the network in those roles (Oracle LB / DNS proxy / DNS recursive resolver).

Treat this as a medium-high priority: it can be triggered remotely over the network and can lead to Denial of Service or erratic behavior, which can disrupt customer traffic. While the provided information does not show confirmed exploitation in the wild, the vulnerability is critical in severity and the fix is available.

If you use the affected roles (Oracle LB or DNS proxy/recursive resolver), prioritize patching on your next maintenance window or sooner.