Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredictable or…

CVE-2026-8655 is a cluster of memory-overflow bugs in Citrix NetScaler ADC and NetScaler Gateway that trigger *unpredictable behavior* and denial of service when the appliance is configured as a Load Balancer of type Oracle, a DNS Proxy, or a DNS recursive resolver. Affected builds are NetScaler ADC/Gateway 14.1 < 14.1-72.61 and 13.1 < 13.1-63.18, plus the FIPS and NDcPP variants (13.1-37.272 FIPS/NDcPP and 14.1-72.61 FIPS). The bug is reachable over the network with no authentication and no user interaction — but the *reachable* payload is availability, not code execution.

The vendor originally stamped this CRITICAL 9.8 in the initial advisory feed, but Citrix's own CVSS v4 vector tells the truer story: VC:L/VI:L/VA:H — high availability impact, only low confidentiality and integrity. That is a DoS bug with edge-appliance blast radius, not a remote code execution. CRITICAL is inflated; HIGH is correct. The impact is real (edge outages take VPN and app access down for the whole workforce), but the ceiling is a crash loop, not a shell.

Why this verdict

• Impact ceiling is availability, not code execution: Citrix's v4 vector caps confidentiality/integrity at Low. The vendor 9.8 is a v3.1 auto-inflation; the true blast radius is crash/erratic behavior.
• Narrow config prerequisites: Only Oracle-LB, DNS Proxy, and DNS recursive resolver configurations are affected. Most enterprise NetScaler deployments are Gateway/ICA/HTTP-LB and are not on the target list. This is a compounding downward pressure — estimate <15% of deployed NetScaler instances match a vulnerable role.
• Role multiplier — network edge appliance: NetScaler ADC/Gateway is on the canonical high-value-role list (edge). Even for a DoS-only bug, availability loss on the edge is a fleet-scale outage for the workforce behind it. This is why the verdict floors at HIGH rather than falling to MEDIUM despite the narrow config gate.
• No exploitation signal: EPSS 0.0046, not KEV, no public PoC. GreyNoise is quiet. This lowers urgency below the RCE siblings in the same bulletin (CVE-2026-8451 file read is the one attackers will grab first).
• Unauthenticated + network reachable keeps this above MEDIUM: when a vulnerable configuration exists, no auth is required to trigger it.

Why not higher?

CRITICAL requires either RCE-class impact or an active exploitation signal on a canonical high-value role. Neither holds: the vector is DoS-primary and there is no in-the-wild evidence. Sibling CVE-2026-8451 (file read, potential session token exposure) is the CRITICAL-caliber bug in this bulletin, not 8655.

Why not lower?

MEDIUM would ignore the deployment role — a DoS on the enterprise VPN/app edge is not equivalent to a DoS on a leaf service. The unauthenticated, network-reachable nature and the fleet-scale availability blast radius keep this firmly HIGH.

1. Restrict DNS Proxy / recursive-resolver listeners to trusted segments — If the appliance runs add dns nameServer or add lb vserver … DNS, ACL the listener via NetScaler Access Control Lists or upstream firewall to internal resolvers only. Do this within 30 days per the noisgate mitigation SLA for HIGH.
2. Front the Oracle-LB VIP with a segmentation firewall — Oracle-LB VIPs should never be reachable from user segments. If they are, add a stateful firewall rule allowlisting only application-tier source IPs. Complete within 30 days.
3. Confirm HA pair is active/passive and health checks trigger failover — A single-node crash should not cause user-visible outage if HA is healthy. Run a failover drill and validate show ha node state. Do this alongside patch scheduling.
4. Upgrade to the fixed builds — Move to 14.1-72.61, 13.1-63.18, or the matching FIPS/NDcPP builds within the noisgate remediation window of 180 days — sooner if any of the sibling CVEs in the same bulletin (especially CVE-2026-8451) apply.

Run on the NetScaler shell as nsroot (or any read-capable admin) to compare the running build against the fixed thresholds. Example: ssh nsroot@netscaler01 'bash /var/tmp/check_cve_2026_8655.sh'. No write privileges required.

#!/usr/bin/env bash
# noisgate: CVE-2026-8655 NetScaler ADC/Gateway version check
# Run on the NetScaler BSD shell as nsroot or read-capable admin.
set -u

VERSION_RAW=$(/netscaler/nsapimgr -d version 2>/dev/null || show ns version 2>/dev/null || uname -a)
BUILD=$(echo "$VERSION_RAW" | grep -oE 'NS[0-9]+\.[0-9]+[[:space:]]+Build[[:space:]]+[0-9]+\.[0-9]+' | head -n1)

if [ -z "$BUILD" ]; then
  echo "UNKNOWN: could not parse NetScaler version from: $VERSION_RAW"
  exit 2
fi

TRAIN=$(echo "$BUILD" | grep -oE 'NS[0-9]+\.[0-9]+' | tr -d 'NS')
BUILDNUM=$(echo "$BUILD" | awk '{print $NF}')
MAJOR=$(echo "$BUILDNUM" | cut -d. -f1)
MINOR=$(echo "$BUILDNUM" | cut -d. -f2)

IS_FIPS=0
echo "$VERSION_RAW" | grep -qiE 'FIPS|NDcPP' && IS_FIPS=1

case "$TRAIN" in
  14.1)
    # Fixed: 72.61 (both non-FIPS and FIPS)
    if [ "$MAJOR" -gt 72 ] || { [ "$MAJOR" -eq 72 ] && [ "$MINOR" -ge 61 ]; }; then
      echo "PATCHED: 14.1 build $BUILDNUM >= 72.61"; exit 0
    else
      echo "VULNERABLE: 14.1 build $BUILDNUM < 72.61 (fixed in 14.1-72.61)"; exit 1
    fi
    ;;
  13.1)
    if [ "$IS_FIPS" -eq 1 ]; then
      # Fixed FIPS/NDcPP: 37.272
      if [ "$MAJOR" -gt 37 ] || { [ "$MAJOR" -eq 37 ] && [ "$MINOR" -ge 272 ]; }; then
        echo "PATCHED: 13.1-FIPS build $BUILDNUM >= 37.272"; exit 0
      else
        echo "VULNERABLE: 13.1-FIPS build $BUILDNUM < 37.272"; exit 1
      fi
    else
      # Fixed: 63.18
      if [ "$MAJOR" -gt 63 ] || { [ "$MAJOR" -eq 63 ] && [ "$MINOR" -ge 18 ]; }; then
        echo "PATCHED: 13.1 build $BUILDNUM >= 63.18"; exit 0
      else
        echo "VULNERABLE: 13.1 build $BUILDNUM < 63.18 (fixed in 13.1-63.18)"; exit 1
      fi
    fi
    ;;
  *)
    # 12.x is EoL; 13.0 is EoL. Anything else = out of support.
    echo "UNKNOWN: train $TRAIN is not covered by CVE-2026-8655 advisory or is end-of-life"; exit 2
    ;;
esac

Sources

1. Citrix / NetScaler Security Bulletin (mirror, Kraft Kennedy)
2. The Hacker News — Citrix Patches Six NetScaler Flaws
3. SecurityWeek — Citrix Patches NetScaler Vulnerabilities Including HTTP/2 Bomb
4. runZero — NetScaler ADC & Gateway impacted-systems query
5. GBHackers — NetScaler Memory Overread and DoS
6. CybersecurityNews — NetScaler DoS and Memory Overflow
7. CCB Belgium — Advisory on Citrix NetScaler high-severity cluster
8. OffSeq Threat Radar — NetScaler HTTP/2 Bomb & sibling CVEs