CVE-2026-107412

{
  "etk_id": "ETK-2026-4342",
  "cve_id": "CVE-2026-107412",
  "display_id": "CVE-2026-107412",
  "ghsa_id": "GHSA-9qgc-v9gw-wm22",
  "euvd_id": "EUVD-2026-124828",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Memory overflow in NetScaler ADC and Gateway",
  "summary": "NetScaler ADC and NetScaler Gateway contain memory-overflow vulnerabilities. An attacker may cause denial of service or unpredictable behavior where the affected service and relevant configuration are exposed. Systems not using the relevant configuration may not be affected.",
  "mitigation": "Upgrade NetScaler ADC to 14.1-73.57 or 13.1-64.39, or to 14.1-73.58 FIPS or 13.1-37.293 FIPs and NDcPP where applicable. Upgrade NetScaler Gateway to 14.1-73.57 or 13.1-64.39, and restrict exposure of affected services until upgrades are complete.",
  "vendor": "Citrix NetScaler",
  "product": "ADC",
  "affected": [
    {
      "affected_notes": [
        ">= 0, < 14.1-73.58 FIPS",
        ">= 0, < 13.1-37.293 FIPs and NDcPP"
      ],
      "affected_ranges": [
        ">= 0, < 14.1-73.57",
        ">= 0, < 13.1-64.39"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "14.1-73.57",
        "13.1-64.39",
        "14.1-73.58 FIPS",
        "13.1-37.293 FIPs and NDcPP"
      ],
      "package_name": "ADC",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 14.1-73.57",
        ">= 0, < 13.1-64.39"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "14.1-73.57",
        "13.1-64.39"
      ],
      "package_name": "Gateway",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 9.061964933333334,
  "t0_at": "2026-11-13T02:21:30.835000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-13T02:21:30.835000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-13T02:21:30.835000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107412"
    }
  }
}