A Citrix NetScaler out-of-bounds read given a next-day due date — one day against a median grace period of 21

1An unusual one-day grace period

Every entry in the CISA Known Exploited Vulnerabilities catalog carries a due date by which federal agencies are to complete remediation. Across the 1,687 records this site holds as of 2026-09-02, the grace period from the date added to the due date has a median of 21 days and a maximum of 184. What this entry received was the shortest possible: one day. Remediate by tomorrow.

2Where it falls in the distribution

The length of a due date reads as a judgment reflecting the state of exploitation and the difficulty of remediation. A median of 21 days sits roughly within a monthly patch cycle. A one-day due date means acting without waiting for the next scheduled window.

3What gets read out

The class of fault here is an out-of-bounds read: the program reads memory past the region it allocated. Unlike a write it does not directly execute code, but whatever happened to be sitting in that region leaves in the response. If values used for authentication are among them, that alone becomes a foothold.

The condition applies when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server.

4The character of a device on the perimeter

A VPN gateway is placed as the single door from outside into the internal network. Being a door, it must be reachable from the internet, and authentication material flows through it. This record also notes that use in ransomware campaigns is known. The required action is to apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use. Verify applicability with official vendor information and your own environment.