CVE-2026-107414: Memory overflow in WebAuth authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway

Key facts

Vendor rating

High, CVSS 8.7

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N · base score 8.7, scored by NetScalerAttack vector: network. Attack complexity: low. Attack requirements: none. Privileges required: none. User interaction: none. Confidentiality impact on the vulnerable system: none. Integrity impact on the vulnerable system: none. Availability impact on the vulnerable system: high. Confidentiality impact on subsequent systems: none. Integrity impact on subsequent systems: none. Availability impact on subsequent systems: none.

EPSS

0.31% chance of exploitation in the next 30 days (23rd percentile). FIRST EPSS, Nov 13, 2026.

CISA KEV

Not listed (catalogue checked Nov 15, 2026)

Affected

NetScaler ADC before 14.1-73.57; NetScaler ADC before 13.1-64.39; NetScaler ADC before 14.1-73.58 FIPS and 3 more below

Fixed in

14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS and 1 more below

Source published

Nov 13, 2026

Listed by VulniPulse

Nov 13, 2026

Compiled by VulniPulse from the linked sources. How records are collected and checked.

More NetScaler (Citrix) advisories

• CVE-2026-120867Nov 13, 2026Memory overflow in SSL/TLS/DTLS
• CVE-2026-120866Nov 13, 2026Memory overflow / improper handling in BGP dynamic routing
• CVE-2026-120865Nov 13, 2026Memory overflow in HTTP/3 (QUIC)
• CVE-2026-120864Nov 13, 2026Memory overflow in ICA proxy
• CVE-2026-120863Nov 13, 2026Memory overflow in the management plane
• CVE-2026-120862Nov 13, 2026Memory overflow in SIP ALG (LSN) and DNS answer-section logging datapaths

NetScaler (Citrix) advisories, November 2026All NetScaler (Citrix) advisories