Alert GCSA-26114 - Vulnerabilita' in prodotti Citrix
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
******************************************************************
Alert ID: GCSA-26114
Data: 7 luglio 2026
Titolo: Vulnerabilita' in prodotti Citrix
******************************************************************
:: Descrizione del problema
Citrix ha rilasciato aggiornamenti di sicurezza per risolvere sei vulnerabilita' presenti in
NetScaler ADC (precedentemente Citrix ADC) e NetScaler Gateway (precedentemente Citrix Gateway).
La vulnerabilita' CVE-2026-8451 (CVSS score of 8.8) e' attualmente oggetto di sfruttamento.
Per essere vulnerabile, NetScaler ADC o NetScaler Gateway devono essere configurati come provider di identita' SAML.
Lo sfruttamento efficace della vulnerabilita' non richiede autenticazione.
Maggiori informazioni sono disponibili alla sezione "Riferimenti".
:: Software interessato
NetScaler ADC e NetScaler Gateway versioni precedenti alla 14.1-72.61
NetScaler ADC e NetScaler Gateway versioni precedenti alla 13.1-63.18
NetScaler ADC FIPS versioni precedenti alla 14.1-72.61 FIPS
NetScaler ADC FIPS e NDcPP versioni precedenti alla 13.1-37.272
:: Impatto
Lettura arbitraria di file
Denial of Service (DoS)
Accesso a dati riservati (ID)
:: Soluzioni
Aggiornare i prodotti alle ultime versioni.
https://docs.netscaler.com/en-us/citrix-adc/current-release/upgrade-downgrade-citrix-adc-appliance.html
https://docs.netscaler.com/en-us/citrix-adc/current-release/upgrade-downgrade-citrix-adc-appliance/upgrade-standalone-appliance.html
https://support.citrix.com/external/article/CTX691210/netscaler-upgrades-and-general-configura.html
https://www.citrix.com/downloads/citrix-adc/
:: Riferimenti
Citrix Security Bulletin
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604
The Hacker News
https://thehackernews.com/2026/07/citrix-patches-six-netscaler-flaws.html
SecurityWeek
https://www.securityweek.com/citrix-patches-netscaler-vulnerabilities-including-new-http-2-bomb-attack/
https://www.securityweek.com/new-citrixbleed-vulnerability-exploited-immediately-after-public-disclosure/
Mitre CVE
https://www.cve.org/CVERecord?id=CVE-2026-8451
https://www.cve.org/CVERecord?id=CVE-2026-8452
https://www.cve.org/CVERecord?id=CVE-2026-8655
https://www.cve.org/CVERecord?id=CVE-2026-10816
https://www.cve.org/CVERecord?id=CVE-2026-10817
https://www.cve.org/CVERecord?id=CVE-2026-13474
GARR CERT Security Alert - subscribe/unsubscribe:
https://www.cert.garr.it/alert/ricevi-gli-alert-di-cert
-----BEGIN PGP SIGNATURE-----
iF0EAREIAB0WIQTGpdiR5MqstacBGHbBnEyTZRJgQgUCakyzSAAKCRDBnEyTZRJg
QoifAJ9Aqw3Pn9/nEOpHjW7kl2HLiijIBwCdGRzIJKI6nr3aPGTiv9/okJxbB90=
=msTa
-----END PGP SIGNATURE-----
Hash: SHA256
******************************************************************
Alert ID: GCSA-26114
Data: 7 luglio 2026
Titolo: Vulnerabilita' in prodotti Citrix
******************************************************************
:: Descrizione del problema
Citrix ha rilasciato aggiornamenti di sicurezza per risolvere sei vulnerabilita' presenti in
NetScaler ADC (precedentemente Citrix ADC) e NetScaler Gateway (precedentemente Citrix Gateway).
La vulnerabilita' CVE-2026-8451 (CVSS score of 8.8) e' attualmente oggetto di sfruttamento.
Per essere vulnerabile, NetScaler ADC o NetScaler Gateway devono essere configurati come provider di identita' SAML.
Lo sfruttamento efficace della vulnerabilita' non richiede autenticazione.
Maggiori informazioni sono disponibili alla sezione "Riferimenti".
:: Software interessato
NetScaler ADC e NetScaler Gateway versioni precedenti alla 14.1-72.61
NetScaler ADC e NetScaler Gateway versioni precedenti alla 13.1-63.18
NetScaler ADC FIPS versioni precedenti alla 14.1-72.61 FIPS
NetScaler ADC FIPS e NDcPP versioni precedenti alla 13.1-37.272
:: Impatto
Lettura arbitraria di file
Denial of Service (DoS)
Accesso a dati riservati (ID)
:: Soluzioni
Aggiornare i prodotti alle ultime versioni.
https://docs.netscaler.com/en-us/citrix-adc/current-release/upgrade-downgrade-citrix-adc-appliance.html
https://docs.netscaler.com/en-us/citrix-adc/current-release/upgrade-downgrade-citrix-adc-appliance/upgrade-standalone-appliance.html
https://support.citrix.com/external/article/CTX691210/netscaler-upgrades-and-general-configura.html
https://www.citrix.com/downloads/citrix-adc/
:: Riferimenti
Citrix Security Bulletin
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604
The Hacker News
https://thehackernews.com/2026/07/citrix-patches-six-netscaler-flaws.html
SecurityWeek
https://www.securityweek.com/citrix-patches-netscaler-vulnerabilities-including-new-http-2-bomb-attack/
https://www.securityweek.com/new-citrixbleed-vulnerability-exploited-immediately-after-public-disclosure/
Mitre CVE
https://www.cve.org/CVERecord?id=CVE-2026-8451
https://www.cve.org/CVERecord?id=CVE-2026-8452
https://www.cve.org/CVERecord?id=CVE-2026-8655
https://www.cve.org/CVERecord?id=CVE-2026-10816
https://www.cve.org/CVERecord?id=CVE-2026-10817
https://www.cve.org/CVERecord?id=CVE-2026-13474
GARR CERT Security Alert - subscribe/unsubscribe:
https://www.cert.garr.it/alert/ricevi-gli-alert-di-cert
-----BEGIN PGP SIGNATURE-----
iF0EAREIAB0WIQTGpdiR5MqstacBGHbBnEyTZRJgQgUCakyzSAAKCRDBnEyTZRJg
QoifAJ9Aqw3Pn9/nEOpHjW7kl2HLiijIBwCdGRzIJKI6nr3aPGTiv9/okJxbB90=
=msTa
-----END PGP SIGNATURE-----