CVE-2026-10816: Citrix NetScaler ADC File Read Vulnerability

CVE-2026-10816 Overview

CVE-2026-10816 is an unauthenticated arbitrary file read vulnerability affecting Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway. The flaw is exposed when access to the NetScaler IP (NSIP), Cluster Management IP, or Subnet IP (SNIP) with management access is enabled. An adjacent-network attacker can read files from the appliance without providing credentials.

Citrix classifies the issue under CWE-73 (External Control of File Name or Path) and CWE-610 (Externally Controlled Reference to a Resource in Another Sphere).

Critical Impact
An unauthenticated attacker with adjacent network access to the NSIP, Cluster Management IP, or a management-enabled SNIP can read arbitrary files, potentially exposing configuration data, credentials, and cryptographic material.

Affected Products

Citrix NetScaler Application Delivery Controller (including FIPS and NDcPP builds)
Citrix NetScaler ADC 14.1-66.68 FIPS
Citrix NetScaler Gateway

Discovery Timeline

2026-06-30 - CVE-2026-10816 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-10816

Vulnerability Analysis

CVE-2026-10816 allows an unauthenticated actor to read files from a NetScaler appliance when management interfaces are network-reachable. The vulnerability requires adjacent network access to a management-capable interface (NSIP, Cluster Management IP, or a SNIP with management access enabled). No user interaction and no privileges are required to trigger the flaw.

The confidentiality impact is high because files accessible to the appliance process may include configuration exports, session data, and secrets used by the ADC and Gateway services. Integrity and availability impacts are limited: the primitive is a read, not a write or code execution.

Root Cause

The vulnerability is rooted in improper handling of externally supplied file references. Under [CWE-73], the appliance accepts a file path or resource reference from a caller without validating that the target resides within an authorized boundary. Combined with [CWE-610], the management service resolves a controlled reference into content from a more privileged sphere, returning file data to the requester without authentication.

Attack Vector

Exploitation requires network reachability to a NetScaler management interface. Deployments that restrict NSIP, Cluster Management IP, and SNIP management access to isolated administration networks reduce exposure. Environments that expose these interfaces to broader corporate segments or partner networks widen the attack surface. Refer to the Citrix Knowledge Base Article CTX696604 for authoritative technical details.

No public proof-of-concept has been published, and the vulnerability is not listed in CISA KEV. The EPSS estimate at publication was low, but exposure of management planes historically attracts targeted probing.

Detection Methods for CVE-2026-10816

Indicators of Compromise

Unexpected HTTP or HTTPS requests to management endpoints on the NSIP, Cluster Management IP, or a SNIP with management access enabled.
Access log entries showing unauthenticated file retrieval requests referencing configuration or system paths.
Outbound transfer of NetScaler configuration files, ns.conf fragments, or certificate material to unfamiliar destinations.

Detection Strategies

Alert on any request to NetScaler management interfaces originating from non-administrative source networks.
Correlate NetScaler access logs with firewall telemetry to identify unauthenticated sessions that transfer file-like payloads.
Baseline management-plane traffic volume and flag deviations that suggest bulk file extraction.

Monitoring Recommendations

Forward NetScaler management and audit logs to a centralized log platform with retention sufficient for retrospective hunts.
Monitor for repeated 200-status responses to unauthenticated management URIs.
Track configuration and certificate access patterns and alert on off-hours retrievals.

How to Mitigate CVE-2026-10816

Immediate Actions Required

Inventory every NetScaler ADC and Gateway appliance and identify interfaces where NSIP, Cluster Management IP, or SNIP management access is reachable.
Restrict management interface exposure to a dedicated administrative network segment or jump host.
Rotate credentials, API keys, and certificates that may have been readable from the appliance file system.
Apply the fixed builds published by Citrix as documented in CTX696604.

Patch Information

Citrix has published remediation guidance and fixed firmware versions in Citrix Knowledge Base Article CTX696604. Administrators should upgrade all affected ADC and Gateway appliances, including FIPS and NDcPP variants, to the fixed builds referenced in that advisory.

Workarounds

Disable management access on any SNIP where it is not operationally required.
Enforce network access control lists that permit management traffic only from authorized administrator subnets.
Place management interfaces behind a VPN or bastion host and block direct reachability from user or partner networks.
Monitor and rate-limit unauthenticated requests to NetScaler management endpoints until patching is complete.

bash

# Configuration example: restrict management access on a SNIP
# Replace <snip-address> with the appliance SNIP
set ns ip <snip-address> -mgmtAccess DISABLED

# Verify the setting
show ns ip <snip-address>