Citrix has released critical security patches for multiple vulnerabilities in its NetScaler ADC and NetScaler Gateway products, which could allow attackers to read arbitrary files or trigger a denial-of-service (DoS) condition. These flaws, collectively known as the 'Citrix Bleed' vulnerabilities, have a high potential for exploitation and should be addressed immediately by users. The vulnerabilities include CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, and CVE-2026-13474, each with a CVSS score of 8.8 or higher. These issues stem from memory management vulnerabilities, insufficient input validation, and external control of file names, which could lead to severe security breaches. The patches are available for NetScaler ADC and NetScaler Gateway versions 14.1-72.61 and later, 13.1-63.18 and later, and 13.1-FIPS and 13.1-NDcPP 13.1.37.272 and later. Additionally, customers are advised to update their configurations for CVE-2026-13474 by modifying the Http2SmallWndTimeout parameter. While no evidence of in-the-wild exploitation exists, the potential impact of these vulnerabilities is significant, making prompt patching essential for maintaining network security. The discovery of these vulnerabilities highlights the ongoing challenges in securing Citrix appliances, which have been targeted by threat actors for ransomware deployment in the past. As such, users are urged to prioritize the application of these patches to mitigate the risks associated with these critical vulnerabilities.
