A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands

Why this deserves its current priority

CVSS is 9.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Citrix NetScaler/ADC (generic), Citrix NetScaler/Gateway (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Citrix NetScaler/ADC, Citrix NetScaler/Gateway.
2. 2Review the reported fix. Update Citrix NetScaler/ADC to 14.1-73.37; Citrix NetScaler/Gateway to 14.1-73.37 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Sep 27, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 27, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Sep 27, 2026

Sources and claim methodology

• Source referencesupport.citrix.com
• CISA Known Exploited Vulnerabilities catalogcisa.gov

Related CVEs

• Memory overflow vulnerability leading to Remote Code Execution or Denial of ServiceSame citrix netscaler/adc package
• HTTP Request SmugglingSame citrix netscaler/adc package
• Feature policy bypass due to improper HTTP URL based expression usageSame citrix netscaler/adc package
• Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of ServiceSame citrix netscaler/adc package
• Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of ServiceSame citrix netscaler/adc package
• Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of ServiceSame citrix netscaler/adc package