What is CVE-2026-8655?

CVE-2026-8655 is a critical-severity vulnerability in Citrix Netscaler Application Delivery Controller, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 9.8/10. Published 2026-06-30.

How severe is CVE-2026-8655?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Buffer overflow in Citrix Netscaler Application Delivery Controller

CVE-2026-8655

Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if NetScaler ADC is configured as an LB of type Oracle OR NetScaler ADC is configured as a DNS Proxy OR NetScaler ADC is configured as a DNS recursive resolver deployment

Vulnerability class: Buffer Overflow

EPSS: 0.005 (39.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Citrix Netscaler_application_delivery_controller — versions 14.1-66.68
Citrix Netscaler_gateway
Netscaler Adc — versions 14.1, 13.1, 14.1 FIPS
Netscaler Gateway — versions 14.1, 13.1

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

50a63c94-1ea7-4568-8c11-eb79e7c5a2b5 (Vendor Advisory)

Frequently asked questions

What is CVE-2026-8655?: CVE-2026-8655 is a critical-severity vulnerability in Citrix Netscaler Application Delivery Controller, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 9.8/10. Published 2026-06-30.
How severe is CVE-2026-8655?: Critical severity. CVSS v3 base score is 9.8 out of 10.