NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, and CVE-2026-13474

• NetScaler ADC and NetScaler Gateway
• The following supported versions of NetScaler ADC and NetScaler Gateway are affected by the vulnerabilities: NetScaler ADC and NetScaler Gateway 14.1 BEFORE 14.1-72.61 NetScaler ADC and NetScaler Gateway 13.1 BEFORE 13.1-63.18 NetScaler ADC FIPS BEFORE 14.1-72.61 FIPS NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.272 Note: Secure Private Access Hybrid deployments using NetScaler instances are also affected by the vulnerabilities. Customers need to upgrade these NetScaler instances to the recommended NetScaler builds to address the vulnerabilities. This bulletin only applies to customer-managed NetScaler ADC and NetScaler Gateway. Cloud Software Group upgrades the Citrix-managed cloud services and Citrix-managed Adaptive Authentication with the necessary software updates. Blog Cloud Software Group team has published a related blog at: https://community.citrix.com/techzone-blogs/110_security-updates/security-update-for-citrix-netscaler-and-netscaler-gateway-customers-r1570/ which contains further context.

Cloud Software Group strongly urges affected customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions as soon as possible. NetScaler ADC and NetScaler Gateway 14.1-72.61 and later releases NetScaler ADC and NetScaler Gateway 13.1-63.18 and later releases of 13.1 NetScaler ADC 14.1-FIPS 14.1-72.61 FIPS and later releases of 14.1-FIPS NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.272 and later releases of 13.1-FIPS and 13.1-NDcPP CVE-2026-13474 Customers must upgrade to the above-mentioned NetScaler firmware versions that include the fix and update their configuration as described below. Configure the Http2SmallWndTimeout parameter, which controls the timeout (in seconds) for HTTP/2 small‑window stalled streams. For appliances using HTTP Strict Profiles, this parameter defaults to 30 seconds, and the fix is effective immediately after the upgrade. For appliances NOT using HTTP Strict Profiles, the default value is 0, and in that case, merely upgrading to the builds containing the fix WILL NOT address the vulnerability completely. In this case, customers must manually set Http2SmallWndTimeout to 30 seconds. Please note that Http2SmallWndTimeout is a new parameter and is only available in the firmware builds that contain the fix. Configuration command: set ns httpProfile -http2SmallWndTimeout

SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.

1. Aug 20, 2026 at 7:02 PM UTC
   • Added affected products: The following supported versions of NetScaler ADC and NetScaler Gateway are affected by the vulnerabilities: NetScaler ADC and NetScaler Gateway 14.1 BEFORE 14.1-72.61 NetScaler ADC and NetScaler Gateway 13.1 BEFORE....
   • Removed affected products: The following supported versions of NetScaler ADC and NetScaler Gateway are affected by the vulnerabilities: NetScaler ADC and NetScaler Gateway 14.1 BEFORE 14.1-72.61 NetScaler ADC and NetScaler....
   • Added fixed versions: NetScaler ADC and NetScaler Gateway 13.1-63.18 and later releases of 13.1, NetScaler ADC and NetScaler Gateway 14.1-72.61 and later releases.
   • Removed fixed versions: NetScaler ADC and NetScaler Gateway 13.1-63.18 and later releases of 13.1, NetScaler ADC and NetScaler Gateway 14.1-72.61 and later releases.
   • The vendor changed its remediation guidance.

1. Jul 20, 2026 at 2:33 PM UTC
   Published by Citrix

   The publication date reported by the vendor.

2. Aug 20, 2026 at 6:53 PM UTC
   Added to SecurityAlert

   We collected the advisory from the official source.

3. Sep 13, 2026 at 4:50 AM UTC
   Confirmed at the source

   Our collector saw this advisory during a later source check.