# CVE-2026-13474: NetScaler ADC and Gateway denial of service via malformed HTTP/2 requests

Source: https://junglewise.ai/threats/cve-2026-13474-netscaler-adc-and-gateway-denial-of-service-via-malformed-http-2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-13474 · Severity: info · CVSS 8.7 · Published 2026-06-30

NetScaler ADC and Gateway appliances are vulnerable to a denial-of-service attack that can crash the system or disrupt network traffic. An attacker can trigger this by sending specially crafted web requests if the HTTP/2 protocol is enabled on the device. This could lead to significant downtime for applications and remote access services relying on these controllers.

## Quick answers

**Is CVE-2026-13474 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13474 being exploited in the wild.

**How severe is CVE-2026-13474?** Informational severity, with a CVSS score of 8.7, published 30 June 2026.

**Which products and versions are affected?** NetScaler ADC 14.1 before 72.61, 13.1 before 63.18, 14.1 FIPS before 72.61, 13.1 FIPS and NDcPP before 37.272; NetScaler Gateway 14.1 before 72.61, 13.1 before 63.18.

**Is there a fix for CVE-2026-13474?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-13474 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-13474?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial-of-service vulnerability exists in NetScaler ADC and NetScaler Gateway due to improper memory management (CWE-401) when handling malformed HTTP/2 requests. The issue occurs when HTTP/2 is enabled in the HTTP Profile and associated with a virtual server (LB, CS, or VPN) or a configured service. A remote, unauthenticated attacker can exploit this by sending crafted HTTP/2 traffic, leading to resource exhaustion or service instability. Patches are available for versions 14.1 and 13.1, including FIPS-validated editions.

## Affected products

- NetScaler ADC 14.1 before 72.61, 13.1 before 63.18, 14.1 FIPS before 72.61, 13.1 FIPS and NDcPP before 37.272
- NetScaler Gateway 14.1 before 72.61, 13.1 before 63.18

## Timeline

- 2026-06-30: advisory: Initial disclosure by NetScaler/Citrix
- 2026-06-30: disclosed

## References

- [https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604)