Is CVE-2026-13474 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13474 being exploited in the wild.

How severe is CVE-2026-13474?

Informational severity, with a CVSS score of 8.7, published 30 June 2026.

Which products and versions are affected?

NetScaler ADC 14.1 before 72.61, 13.1 before 63.18, 14.1 FIPS before 72.61, 13.1 FIPS and NDcPP before 37.272; NetScaler Gateway 14.1 before 72.61, 13.1 before 63.18.

Is there a fix for CVE-2026-13474?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-13474 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-13474?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13474: NetScaler ADC and Gateway denial of service via malformed HTTP/2 requests

CVE-2026-13474 · Severity: info · CVSS 8.7 · Published 2026-06-30

NetScaler ADC and Gateway appliances are vulnerable to a denial-of-service attack that can crash the system or disrupt network traffic. An attacker can trigger this by sending specially crafted web requests if the HTTP/2 protocol is enabled on the device. This could lead to significant downtime for applications and remote access services relying on these controllers.

Quick answers

Is CVE-2026-13474 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13474 being exploited in the wild.
How severe is CVE-2026-13474?: Informational severity, with a CVSS score of 8.7, published 30 June 2026.
Which products and versions are affected?: NetScaler ADC 14.1 before 72.61, 13.1 before 63.18, 14.1 FIPS before 72.61, 13.1 FIPS and NDcPP before 37.272; NetScaler Gateway 14.1 before 72.61, 13.1 before 63.18.
Is there a fix for CVE-2026-13474?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-13474 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-13474?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A denial-of-service vulnerability exists in NetScaler ADC and NetScaler Gateway due to improper memory management (CWE-401) when handling malformed HTTP/2 requests. The issue occurs when HTTP/2 is enabled in the HTTP Profile and associated with a virtual server (LB, CS, or VPN) or a configured service. A remote, unauthenticated attacker can exploit this by sending crafted HTTP/2 traffic, leading to resource exhaustion or service instability. Patches are available for versions 14.1 and 13.1, including FIPS-validated editions.

Affected products

NetScaler ADC 14.1 before 72.61, 13.1 before 63.18, 14.1 FIPS before 72.61, 13.1 FIPS and NDcPP before 37.272
NetScaler Gateway 14.1 before 72.61, 13.1 before 63.18

Timeline

2026-06-30: advisory: Initial disclosure by NetScaler/Citrix
2026-06-30: disclosed

References

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.