Arbitrary File Read

CVE-2026-10816 is a CWE-73 external control of file name/path flaw in NetScaler ADC and NetScaler Gateway. If the appliance's NSIP, Cluster Management IP, or a SNIP with management access enabled is reachable, an attacker can request arbitrary paths off the filesystem without credentials. The interesting reads are /nsconfig/ns.conf (RADIUS/TACACS/LDAP bind creds, monitor passwords), /var/nslog/*, cert/key material under /nsconfig/ssl/, and — depending on layout — cached session state that recapitulates the CitrixBleed exposure. Affected: NetScaler ADC/Gateway 14.1 before 14.1-72.61 and 13.1 before 13.1-63.18, including FIPS and NDcPP variants. Fixed in 14.1-72.61+ and 13.1-63.18+ per Citrix bulletin CTX696604.

The vendor's HIGH / 7.5 rating (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) matches reality — this is *exactly* the right bucket. It's not CRITICAL because integrity/availability aren't directly touched and the attack surface is the management plane, which Citrix has told customers for a decade should never be internet-facing. It's not MEDIUM because the affected component is a network edge appliance and the same CTX696604 bulletin ships CVE-2026-8451, a CitrixBleed-like memory read that Lupovis observed being exploited *within 24 hours of disclosure*. Treat this file-read as bundled urgency: patch it in the same maintenance window as the memory-disclosure sibling.

Why this verdict

• Baseline vendor score is fair. 7.5 HIGH matches an unauthenticated network-reachable confidentiality-only file read on a widely-deployed edge appliance.
• Friction #1 — management plane exposure: Best-practice deployments firewall NSIP/CLIP off the internet. Shodan tail suggests <10% of deployed NetScalers expose the mgmt plane externally. This is real narrowing → keeps the verdict at HIGH rather than pushing to CRITICAL.
• Friction #2 — no public PoC yet: Path is redacted in CTX696604, so mass exploitation requires reverse-engineering the patch diff. That buys defenders roughly 1–2 weeks.
• Role multiplier — network edge appliance: NetScaler Gateway terminates VPN, SSO, and ICA sessions. ns.conf holds LDAP/RADIUS bind creds; /nsconfig/ssl/ holds TLS private keys. Chain ends in credential theft, TLS decryption, or session hijack — canonical fleet-scale outcome. This is the CitrixBleed-adjacent floor: verdict is FLOORED at HIGH.
• Bundled urgency: Sibling CVE-2026-8451 (same bulletin) is under active exploitation. Attackers patch-diffing that CVE will trivially notice -10816 in the same commit range.

Why not higher?

Not CRITICAL because impact is confidentiality-only (no direct code execution, no write primitive, no auth bypass by itself), and the attack surface is the management plane which most mature deployments segment. CRITICAL would require either direct RCE or documented in-the-wild exploitation of this specific CVE — neither is present today.

Why not lower?

Not MEDIUM because the affected component is a network edge / remote-access appliance where a file-read primitive reliably chains to credential theft and MFA-bypassed session hijack, and because a sibling CVE in the same bulletin is already being exploited. Downgrading past the network-edge floor would require evidence that <1% of deployed units expose the mgmt plane — Shodan/Censys data does not support that claim.

1. Firewall NSIP, Cluster Management IP, and any management-enabled SNIP off the public internet — TODAY — This kills the unauthenticated path entirely. Restrict to an ops jump host / bastion subnet. Deploy within 30 days per noisgate mitigation SLA for HIGH; if your mgmt plane is currently internet-exposed, treat it as immediate (hours, not days) — that's already a critical hygiene failure independent of this CVE.
2. Disable -mgmtAccess ENABLED on any SNIP that doesn't strictly need it — Run show ns ip and audit which SNIPs have management access. Turn it off on data-plane SNIPs with set ns ip <SNIP> -mgmtAccess DISABLED. Complete within 30 days.
3. Rotate everything readable from the appliance AFTER patching — Assume ns.conf bind credentials, monitor passwords, and TLS private keys under /nsconfig/ssl/ are burned. Rotate LDAP/RADIUS bind accounts, re-issue certs, and invalidate active Gateway sessions. Complete within 30 days of applying the patch.
4. Deploy NetScaler ADC/Gateway 14.1-72.61 or 13.1-63.18 — Vendor patch is the only durable fix. Apply within the noisgate remediation SLA of 180 days for HIGH — realistically schedule for the next 2-week maintenance window given the actively-exploited sibling CVE in the same bulletin.
5. Deploy WAF signature blocking path traversal against mgmt endpoints — Until patched, block requests to management URIs containing ../, encoded traversal (%2e%2e), or absolute FreeBSD paths (/nsconfig, /var/nslog). Belt-and-suspenders behind the firewall control.

Run this on your auditor/ops workstation (not the NetScaler itself) against each appliance's NSIP over SSH. Requires an nsroot-equivalent read account and SSH key access. Invoke as ./check-ctx696604.sh <NSIP> — example: ./check-ctx696604.sh 10.20.30.40. Exits 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN.

#!/usr/bin/env bash
# noisgate verification: CVE-2026-10816 (CTX696604)
# Checks NetScaler ADC/Gateway build against fixed versions.
set -u

NSIP="${1:-}"
if [[ -z "$NSIP" ]]; then
  echo "Usage: $0 <NSIP>" >&2
  exit 2
fi

# Fixed builds per Citrix CTX696604
FIXED_141="14.1-72.61"
FIXED_131="13.1-63.18"

# Query build via SSH; requires key-based auth for the audit account
VER=$(ssh -o BatchMode=yes -o ConnectTimeout=5 nsroot@"$NSIP" \
      'show ns version' 2>/dev/null | grep -oE 'NS[0-9]+\.[0-9]+.*Build [0-9]+\.[0-9]+' | head -1)

if [[ -z "$VER" ]]; then
  echo "UNKNOWN: could not retrieve version from $NSIP"
  exit 2
fi

# Extract major.minor and build
MAJMIN=$(echo "$VER" | grep -oE 'NS[0-9]+\.[0-9]+' | tr -d 'NS')
BUILD=$(echo "$VER"  | grep -oE 'Build [0-9]+\.[0-9]+' | awk '{print $2}')

cmp_build() {
  # returns 0 if $1 >= $2 (dotted decimal)
  printf '%s\n%s\n' "$2" "$1" | sort -V -C
}

case "$MAJMIN" in
  14.1)
    FIX_BUILD="${FIXED_141#14.1-}"
    if cmp_build "$BUILD" "$FIX_BUILD"; then
      echo "PATCHED: $NSIP running 14.1-$BUILD (>= $FIXED_141)"
      exit 0
    else
      echo "VULNERABLE: $NSIP running 14.1-$BUILD (< $FIXED_141)"
      exit 1
    fi
    ;;
  13.1)
    FIX_BUILD="${FIXED_131#13.1-}"
    if cmp_build "$BUILD" "$FIX_BUILD"; then
      echo "PATCHED: $NSIP running 13.1-$BUILD (>= $FIXED_131)"
      exit 0
    else
      echo "VULNERABLE: $NSIP running 13.1-$BUILD (< $FIXED_131)"
      exit 1
    fi
    ;;
  13.0|12.1|12.0)
    echo "VULNERABLE: $NSIP running EoL train $MAJMIN — no fix, replace/upgrade"
    exit 1
    ;;
  *)
    echo "UNKNOWN: unrecognized train $MAJMIN on $NSIP"
    exit 2
    ;;
esac

Sources

1. Citrix Bulletin CTX696604 coverage — The Hacker News
2. CVE-2026-10816 — OpenCVE
3. CVE-2026-10816 — Tenable
4. PT-2026-53866 — Positive Technologies dbugs
5. NetScaler vulnerabilities: find impacted systems — runZero
6. CCB Belgium advisory — Multiple High Vulnerabilities in Citrix NetScaler
7. CSA Singapore — Multiple Vulnerabilities in NetScaler Products
8. Sibling CVE-2026-8451 active exploitation — CSO Online