CVE-2026-107409: Memory corruption in DNS-over-HTTPS (DoH) can lead to unpredictable or erroneous behavior or a Denial of Service in NetScaler ADC and NetScaler Gateway

Key facts

Vendor rating

Critical, CVSS 9.3

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N · base score 9.3, scored by NetScalerAttack vector: network. Attack complexity: low. Attack requirements: none. Privileges required: none. User interaction: none. Confidentiality impact on the vulnerable system: high. Integrity impact on the vulnerable system: high. Availability impact on the vulnerable system: high. Confidentiality impact on subsequent systems: none. Integrity impact on subsequent systems: none. Availability impact on subsequent systems: none.

EPSS

0.36% chance of exploitation in the next 30 days (30th percentile). FIRST EPSS, Nov 13, 2026.

CISA KEV

Not listed (catalogue checked Nov 15, 2026)

Affected

ADC before 14.1-73.57; ADC before 13.1-64.39; ADC before 14.1-73.58 FIPS and 3 more below

Fixed in

14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS and 1 more below

Source published

Nov 13, 2026

Listed by VulniPulse

Nov 13, 2026

Compiled by VulniPulse from the linked sources. How records are collected and checked.

More NetScaler (Citrix) advisories

• CVE-2026-107413Nov 13, 2026Memory overflow in SAML authentication
• CVE-2026-107412Nov 13, 2026Multiple Memory overflow
• CVE-2026-107411Nov 13, 2026Memory overflow in RTSP ALG
• CVE-2026-107410Nov 13, 2026Memory overflow in NetScaler Push
• CVE-2026-107408Nov 13, 2026Memory corruption in DNS / DNS-over-HTTPS (DoH)
• CVE-2026-107407Nov 13, 2026Memory overflow in SMPP traffic

NetScaler (Citrix) advisories, November 2026All NetScaler (Citrix) advisories