CVE-2026-10817: NetScaler ADC/Gateway Memory Disclosure via TCP TimeStamp – HIGH Severity

Technical summary

CVE-2026-10817 is a CWE-125 (Out-of-bounds Read) vulnerability affecting Citrix NetScaler deployments where TCP TimeStamp is configured in the TCP Profile and linked to a virtual server or service. The flaw stems from inadequate input validation in the TCP TimeStamp processing logic, permitting an unauthenticated remote attacker to craft packets that cause the NetScaler instance to read and potentially leak memory contents. The attack vector is network-based with low complexity and requires no privileges or user interaction, making it straightforward to exploit against exposed instances.

Business impact

This vulnerability enables unauthorized information disclosure from NetScaler memory, which may contain sensitive session tokens, configuration data, or cryptographic material. For organizations using NetScaler as a gateway or load balancer, compromise of in-transit secrets could facilitate downstream lateral movement, session hijacking, or credential theft. The exposure is particularly acute for VPN deployments where authentication tokens and user data transit the affected appliance. Regulatory compliance frameworks (HIPAA, PCI-DSS, SOC 2) typically classify memory disclosure of protected data as a material breach trigger.

Affected systems

Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway are impacted. The vulnerability is conditional: it only manifests when TCP TimeStamp is explicitly enabled in a TCP Profile and that profile is associated with a virtual server (Load Balancing, Content Switching, or VPN type) or a backend service. Organizations without TCP TimeStamp enabled are not at risk. Verify your NetScaler configuration to determine if TCP TimeStamp is active on production virtual servers.

Exploitability

Exploitability is high due to the combination of network accessibility, no authentication requirement, and low attack complexity. An attacker requires only network access to the NetScaler instance and the ability to send crafted TCP packets. No special tools or insider knowledge is necessary. However, successful exploitation requires that the target configuration includes TCP TimeStamp in an active TCP Profile; this configuration is not universal across all NetScaler deployments, which may limit the overall exposure in some environments.

Remediation

Citrix has released security updates addressing this vulnerability. Organizations should prioritize patching across all affected NetScaler ADC and Gateway instances. As an interim mitigation, disable TCP TimeStamp in TCP Profiles unless it is operationally essential. Network segmentation to restrict unauthenticated access to NetScaler management and service interfaces can reduce attack surface. Review NetScaler access logs for evidence of suspicious packet patterns or error indicators following exploitation attempts.

Patch guidance

Consult Citrix's official security advisory for specific version numbers and patch availability across NetScaler ADC and Gateway product lines. Apply patches in a staged rollout, testing in non-production environments first to validate compatibility with existing configurations. Patching should be prioritized for internet-facing or VPN-gateway NetScaler instances. After patching, verify that TCP TimeStamp functionality operates as expected and that no configuration changes are required.

Detection guidance

Monitor NetScaler logs for malformed TCP TimeStamp processing errors or memory access violations correlated with TCP profile activity. Network-based detection is challenging without signatures; however, Intrusion Detection/Prevention Systems (IDS/IPS) should flag abnormal TCP TimeStamp option handling or repeated failed packet processing from untrusted sources. Endpoint Detection and Response (EDR) tools monitoring the NetScaler OS can identify unexpected memory access patterns. Threat hunting should focus on correlating suspicious TCP activity with virtual server access logs and any historical data exfiltration indicators.

Why prioritize this

Despite not being on the Known Exploited Vulnerabilities (KEV) catalog, this vulnerability warrants urgent remediation due to its CVSS 7.5 HIGH score, unauthenticated network exploitability, and information disclosure impact. NetScaler ADC and Gateway are critical infrastructure components handling sensitive user and transaction data; memory disclosure from these systems represents a material risk to confidentiality. The conditional nature of the vulnerability (requiring TCP TimeStamp enablement) should not lower priority—many deployments do enable this feature for performance monitoring. Organizations should treat patching as a critical path item.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible vulnerability with no privilege or user interaction requirements (AV:N, AC:L, PR:N, UI:N). The impact vector emphasizes confidentiality loss (C:H) with no integrity or availability impact (I:N, A:N), consistent with a memory disclosure flaw. The score does not account for the conditional enablement of TCP TimeStamp; however, given the prevalence of this feature in performance-sensitive deployments, the score appropriately reflects real-world risk. Organizations with TCP TimeStamp disabled may evaluate risk differently, but proof of configuration should be independently verified.

Frequently asked questions