Main Vulnerability Database Vulnerabilities #VU135999

External Control of File Name or Path in Citrix Netscaler ADC and Citrix NetScaler Gateway - CVE-2026-10816

Published: June 30, 2026

Vulnerability identifier: #VU135999

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-10816

CWE-ID: CWE-73

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to external control of file name or path in the management interface when handling file access requests. A remote attacker can request arbitrary files to disclose sensitive information.

Exploitation requires access to NSIP, Cluster Management IP, or SNIP with management access enabled.

Affected software

Citrix Netscaler ADC
Citrix NetScaler Gateway

How to mitigate CVE-2026-10816

Install security update from vendor's website.

Citrix Netscaler ADC - addressed in versions 13.1-63.18, 14.1-72.61
Citrix NetScaler Gateway - addressed in versions 13.1-63.18, 14.1-72.61

External References

Related Security Bulletins