Insufficient input validation leading to memory overread in NetScaler ADC and NetScaler Gateway if the TCP…

CVE-2026-10817 is an out-of-bounds read (CWE-125) in the NetScaler TCP stack that fires when the appliance processes the TCP Timestamp option (RFC 7323) during connection setup. If a TCP Profile with tcpTimestamp ENABLED is bound to a virtual server (LB, CS, VPN) or a service, an unauthenticated remote attacker can send a crafted timestamp payload and get back chunks of adjacent process memory in responses. Affected builds are NetScaler ADC/Gateway 14.1 before 14.1-72.61, 13.1 before 13.1-63.18, and the FIPS/NDcPP variants 14.1-72.61 FIPS and 13.1-37.272. All 12.1 and 13.0 branches are already EOL and receive no fix.

Vendor rating of HIGH (7.5) — actually 6.9 in some scoring — is *fair, not inflated*. Unlike its sibling CVE-2026-8451 (the CitrixBleed-2 successor patched in the same bulletin CTX696604), this overread terminates when the read hits a NULL byte or > character, so leaks are bounded in length rather than kilobyte-scale. That reduces the odds of pulling a complete session token in a single request — but it does not eliminate it. Session cookies, TLS session state, and config fragments are still recoverable across repeated probes, and NetScaler is exactly the class of edge appliance attackers *do* mine repeatedly.

Why this verdict

• Role multiplier — network edge appliance: NetScaler is a canonical high-value-role component (VPN + reverse proxy + AAA). A pre-auth leak in this role has a documented history of ending in fleet-scale session hijack (CitrixBleed 2023). Verdict floor is HIGH.
• Pre-auth remote, network-reachable: No credentials, no user interaction, direct TCP path to the vserver — every internet-facing NetScaler is reachable to any origin the appliance is meant to serve.
• Bounded leak reduces primitive strength: NULL/> termination means most session-token candidates are unusable per probe, versus CitrixBleed's kilobyte-scale disclosure. This is the reason we don't push to CRITICAL.
• Configuration gate narrows population: Only appliances with tcpTimestamp ENABLED in a bound TCP profile are exposed. Default profile has it disabled, but performance-tuned deployments frequently flip it on.
• Sibling under active exploitation: CVE-2026-8451 in the same bulletin is being weaponized now; adversary tooling in the code family lowers the cost of pivoting to -10817.

Why not higher?

Not CRITICAL because the overread terminates on common byte values, so single-shot recovery of a complete session token is unreliable — the primitive is materially weaker than CitrixBleed proper. Confidentiality-only impact (I:N, A:N) and no confirmed in-the-wild targeting of this specific CVE also argue against a CRITICAL bump.

Why not lower?

Not MEDIUM because the affected role is a canonical network-edge appliance — the Deployment-Role Blast Radius floor is HIGH for this class of component regardless of individual-primitive friction. Session-token leakage is empirically the endgame here, and enterprises should not wait for a public PoC to appear before treating a NetScaler edge leak as HIGH.

1. Disable TCP Timestamp on all bound TCP profiles until patched — Run show ns tcpProfile and identify any profile with tcpTimestamp ENABLED bound to an LB/CS/VPN vserver or service. Set set ns tcpProfile <name> -tcpTimestamp DISABLED. This kills the vulnerable code path entirely with negligible operational impact (Timestamp is a performance option, not a correctness one). Deploy within 30 days per noisgate mitigation SLA for HIGH.
2. Upgrade to 14.1-72.61 / 13.1-63.18 (or FIPS equivalents) — This is the only durable fix. Stage on HA pair secondary, fail over, validate, then upgrade primary. Complete within 180 days per noisgate remediation SLA — sooner if the sibling CVE-2026-8451 (active exploitation) applies to your build, which it almost certainly does.
3. Force AAA session invalidation post-patch — Run kill aaa session -all after upgrade to invalidate any session cookies that may have been leaked during the exposure window. Users re-authenticate; this is cheap insurance and matches CISA guidance from the original CitrixBleed IR playbook.
4. Hunt for anomalous session reuse from new ASN / geo — Query 90 days of NetScaler AAA logs and downstream StoreFront / IdP logs for the same NSC_AAAC or SAML session ID used from more than one source ASN within its TTL. This is the strongest post-hoc indicator of session hijack, whether via -10817 or -8451.

Run this on an auditor workstation (any Linux/macOS box with SSH access to the NetScaler NSIP) with read-only nsroot or equivalent credentials. Invoke as ./check-cve-2026-10817.sh <NSIP> <user> — for example ./check-cve-2026-10817.sh 10.20.30.40 nsroot. It SSHes in, reads version and every TCP profile's Timestamp setting, and prints VULNERABLE / PATCHED / UNKNOWN.

#!/usr/bin/env bash
# check-cve-2026-10817.sh — noisgate verification for CVE-2026-10817
# Requires: ssh, awk. Read-only nsroot or delegated read account.
set -u
NSIP="${1:-}"
USER="${2:-nsroot}"
if [[ -z "$NSIP" ]]; then
  echo "usage: $0 <NSIP> [user]" >&2
  exit 2
fi

# Pull version banner and TCP profile dump in one round trip.
OUT=$(ssh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=10 \
      "${USER}@${NSIP}" \
      'show ns version; show ns tcpProfile' 2>/dev/null) || {
  echo "UNKNOWN: ssh failed to ${NSIP}"; exit 3; }

VER=$(printf '%s' "$OUT" | awk -F'NS' '/NetScaler NS/ {print $2; exit}' | awk '{print $1}')
if [[ -z "$VER" ]]; then echo "UNKNOWN: could not parse version"; exit 3; fi

# Fixed builds: 14.1-72.61, 13.1-63.18, 14.1-72.61-FIPS, 13.1-37.272
is_patched() {
  local v="$1"
  case "$v" in
    14.1-*) awk -v b="${v#14.1-}" 'BEGIN{split(b,a,"."); exit !(a[1]>72 || (a[1]==72 && a[2]>=61))}' ;;
    13.1-*) awk -v b="${v#13.1-}" 'BEGIN{split(b,a,"."); exit !(a[1]>63 || (a[1]==63 && a[2]>=18) || (a[1]==37 && a[2]>=272))}' ;;
    *) return 2 ;;
  esac
}

is_patched "$VER"; PATCH_RC=$?

# Any TCP profile with tcpTimestamp ENABLED is the exposure gate.
TS_ON=$(printf '%s' "$OUT" | awk '/TCPTIMESTAMP: ENABLED|tcpTimestamp: ENABLED/{c++} END{print c+0}')

echo "Version:       $VER"
echo "TCP profiles with Timestamp ENABLED: $TS_ON"

if [[ $PATCH_RC -eq 0 ]]; then
  echo "PATCHED"; exit 0
fi
if [[ $PATCH_RC -eq 2 ]]; then
  echo "UNKNOWN: unrecognized version scheme ($VER)"; exit 3
fi
if [[ $TS_ON -gt 0 ]]; then
  echo "VULNERABLE"; exit 1
fi
echo "VULNERABLE (unpatched build; disable TCP Timestamp is a mitigation, not a fix)"
exit 1

Sources

1. NVD — CVE-2026-10817
2. Cloud Software Group Bulletin CTX696604 (via Kraft Kennedy mirror)
3. The Hacker News — Citrix Patches Six NetScaler Flaws
4. watchTowr Labs — CitrixBleed To Infinity And Beyond (CVE-2026-8451 sibling primitive)
5. CyberScoop — Citrix patches NetScaler flaw with echoes of CitrixBleed
6. CCB Belgium — Multiple High Vulnerabilities in Citrix NetScaler
7. CSA Singapore Alert AL-2026-082
8. GBHackers — NetScaler Memory Overread and DoS Flaws