CVE-2026-8655 is a set of memory overflow bugs in NetScaler ADC and NetScaler Gateway (CVSS 9.8, critical). They cause unpredictable behavior and denial of service in specific configurations. Check Citrix bulletin CTX696604 for fixed builds. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
The record names NetScaler ADC and NetScaler Gateway. It says the issue applies if the ADC is configured as a load balancer of type Oracle, as a DNS proxy, or as a DNS recursive resolver. The weakness is CWE-119, improper restriction of operations within a memory buffer.
The Citrix page was not readable from my tooling, so I cannot list affected or fixed builds. Take them from the bulletin. The record is not in the CISA KEV catalog.
How to check if you're exposed
Check your NetScaler build and configuration from the CLI.
show ns version
show lb vserver
show dns nameServer
Look for load balancers of type Oracle and for DNS proxy or recursive resolver use. If none is present, the record says the condition is not met, but still read the bulletin.
What to do now
- Open Citrix bulletin CTX696604 and identify the fixed build for your release line.
- Upgrade the appliance to that build.
- Check which of the three configurations you run and prioritize those appliances.
- Limit the exposure of DNS services on the appliance to networks that need them.
- Subscribe to Citrix security bulletins.
Why it matters
A memory overflow lets data run past the end of the space reserved for it, which can corrupt neighboring memory. The record states a denial of service result, though the score of 9.8 reflects the possibility of worse outcomes.
NetScaler sits at the edge of many networks. Because the condition depends on configuration, an inventory of which role each appliance plays tells you how urgent the update is.
Quick check
Do I need the update if I do not use DNS proxy or Oracle load balancing?
The record says the issue applies to those configurations. Still read the bulletin and plan the update, since builds change.
Sources
Last reviewed: 19 October 2026.
