NetScaler Security Bulletin June 2026: What Law Firms Should Know
Cloud Software Group (Citrix) published a security bulletin this week covering six vulnerabilities in NetScaler ADC and NetScaler Gateway. These are the appliances a lot of law firms use for remote access, load balancing, and application delivery — so it’s worth cutting through the noise and figuring out what actually needs attention.
Here’s what we found after going through the bulletin.
The Short Version
| Severity | What |
|---|---|
| 🚨 Patch now | CVE-2026-10816 — Unauthenticated arbitrary file read. If an attacker can reach your management interface, they can read files without logging in. |
| ⚠️ Patch soon | CVE-2026-8451, CVE-2026-8452, CVE-2026-8655 — Memory vulnerabilities that could lead to denial of service or data exposure. Pre-conditions apply. |
| 🟡 Check your config | CVE-2026-10817, CVE-2026-13474 — Require specific profile settings to be exploitable. Not every deployment is at risk. |
CVE-2026-10816 — The One That Mattered Most
CVSS v4.0: 7.1 — Unauthenticated Arbitrary File Read
An attacker with network access to the NSIP, Cluster Management IP, or a SNIP with management access enabled can read arbitrary files from the appliance with zero authentication. No credentials needed, no login required.
For a law firm, consider what sits on or is reachable through these appliances: VPN configurations that map your remote access topology, certificate data, and routing tables that show exactly how traffic flows through your network. An attacker who exploits this essentially gets a hand-drawn map of your infrastructure.
The one thing that limits this: the attacker needs access to the management interface. If those interfaces are properly segmented — restricted to trusted internal networks and admin jump boxes — the exposure drops significantly. Worth verifying, though.
The Other Five
CVE-2026-8451 (CVSS 8.8) — SAML IdP Memory Overread
If your NetScaler is configured as a SAML Identity Provider — common at firms that use it for federated single sign-on — this is relevant. The vulnerability is network-based and unauthenticated, meaning an outside attacker could read memory contents without logging in.
To check whether your appliance is configured as a SAML IdP, search your running config for add authentication samlIdPProfile.
CVE-2026-8452 (CVSS 8.8) — Gateway & AAA Memory Overflow
This one affects appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or those with an AAA virtual server. Since the majority of law firms using NetScaler run it as a Gateway for remote attorney access, this has a wider reach than most of the other vulnerabilities in this bulletin.
CVE-2026-8655 (CVSS 8.8) — DNS & Oracle LB Memory Overflows
This requires the appliance to be configured as a DNS proxy, DNS recursive resolver, or Oracle load balancer. Most law firm deployments won’t hit this. Worth noting if your firm routes DNS through NetScaler.
CVE-2026-10817 (CVSS 6.9) — TCP TimeStamp Memory Overread
This one depends entirely on configuration. If the TCP TimeStamp option is enabled in a TCP profile, and that profile is attached to a virtual server or service, the appliance is exposed. Not all deployments will have this turned on — it’s worth checking your TCP profile settings before assuming you’re affected.
CVE-2026-13474 (CVSS 8.7) — HTTP/2 DoS
A denial of service vulnerability that can be triggered with malformed HTTP/2 requests. If you have HTTP/2 enabled in an HTTP profile that’s associated with a virtual server, this applies.
There’s a catch with this one. Upgrading to the fixed firmware alone doesn’t fully close this hole unless you’re using HTTP Strict Profiles. If you’re not, the new Http2SmallWndTimeout parameter defaults to 0 — which means the fix isn’t active. You need to set it to 30 seconds manually after upgrading:
set ns httpProfile <profile_name> -http2SmallWndTimeout 30
Remediation
For IT Teams
First, figure out what you’re working with. Check your firmware versions against the affected ranges: 14.1 before 14.1-72.61, 13.1 before 13.1-63.18, and the corresponding FIPS/NDcPP versions. Then run through the CLI checks listed above to see which CVEs apply to your specific deployment.
Next, plan the upgrade. These are production appliances, so a maintenance window is expected — test in a non-production environment first if you can, then upgrade to the fixed builds.
After the upgrade, a couple of follow-ups:
- If CVE-2026-13474 applies to you and you’re not on HTTP Strict Profiles, don’t forget to set
Http2SmallWndTimeoutto 30 seconds manually. - Audit your management interface access — confirm that NSIP, SNIP, and Cluster Management IP are locked down to trusted administrative networks only.
For Firm Leadership
A few practical questions to bring to your IT team or MSP:
- Are our NetScaler appliances patched against the June 2026 vulnerabilities?
- If you’re not sure whether your firm uses NetScaler — if you use Citrix for remote access or virtual desktops, there’s a good chance it’s in the stack.
- It’s also worth reviewing how security notifications from your vendors reach your team. Bulletins like this come out regularly, and having a process to triage them matters just as much as the patches themselves.
Do you need help or have questions about this advisory? Contact us for more information.
Sources: Citrix Security Bulletin CTX696604; (June 30, 2026)