Citrix Security Bulletins guidance
Vendor revision: Jul 20, 2026Vendor remediation details
Cloud Software Group strongly urges affected customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions as soon as possible. NetScaler ADC and NetScaler Gateway 14.1-72.61 and later releases NetScaler ADC and NetScaler Gateway 13.1-63.18 and later releases of 13.1 NetScaler ADC 14.1-FIPS 14.1-72.61 FIPS and later releases of 14.1-FIPS NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.272 and later releases of 13.1-FIPS and 13.1-NDcPP CVE-2026-13474 Customers must upgrade to the above-mentioned NetScaler firmware versions that include the fix and update their configuration as described below. Configure the Http2SmallWndTimeout parameter, which controls the timeout (in seconds) for HTTP/2 small‑window stalled streams. For appliances using HTTP Strict Profiles, this parameter defaults to 30 seconds, and the fix is effective immediately after the upgrade. For appliances NOT using HTTP Strict Profiles, the default value is 0, and in that case, merely upgrading to the builds containing the fix WILL NOT address the vulnerability completely. In this case, customers must manually set Http2SmallWndTimeout to 30 seconds. Please note that Http2SmallWndTimeout is a new parameter and is only available in the firmware builds that contain the fix. Configuration command: set ns httpProfile -http2SmallWndTimeout
Vendor-listed releases
- NetScaler ADC and NetScaler Gateway 14.1-72.61 and later releases
- NetScaler ADC and NetScaler Gateway 13.1-63.18 and later releases of 13.1
- NetScaler ADC 14.1-FIPS 14.1-72.61 FIPS and later releases of 14.1-FIPS
- NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.272 and later releases of 13.1-FIPS and 13.1-NDcPP