Microsoft technologies are foundational to enterprise IT globally, providing the backbone for operation-critical databases, identity services, core server workloads, and daily productivity applications at many organizations. Greenbone is happy to announce new compliance scans aligned with four CIS Benchmarks for Microsoft environments. CIS Benchmarks provide prescriptive guidance for establishing secure configurations and complement essential security practices such as vulnerability management, endpoint protection, and activity monitoring.

In this article, we briefly review the security focus of each benchmark and explain how Greenbone’s compliance policies help organizations identify configuration gaps across Microsoft Office, SQL Server, and Windows Server systems. OPENVAS SCAN, backed by the industry-leading coverage of the OPENVAS ENTERPRISE FEED, provides the compliance visibility needed to detect insecure settings, prioritize remediation, and strengthen the resilience of Microsoft IT environments.

The new compliance policies for Microsoft IT environments add to Greenbone’s already impressive line of scans:

• CIS Microsoft Office Enterprise Benchmark v1.2.0
• CIS Microsoft SQL Server 2022 Benchmark v1.2.1
• CIS Microsoft Windows Server 2025 Benchmark v2.0.0
• CIS Microsoft Windows Server 2022 Benchmark v5.0.0

The Importance of IT Compliance in 2026

In 2026, organizations operating in the EU face overlapping cyber security, resilience, privacy, and corporate governance obligations. The Network and Information Systems Directive 2 (NIS2) requires critical infrastructure entities to implement technical, operational, and organizational safeguards. The Digital Operational Resilience Act (DORA) imposes additional ICT risk management and resilience requirements on the financial sector. The GDPR imposes security requirements on organizations that process or store personal data, and the Cyber Resilience Act (CRA) introduces mandatory reporting of actively exploited vulnerabilities and severe product security incidents from September 11, 2026, among other obligations.

Following recognized IT security standards such as CIS Benchmarks helps organizations establish defensible security baselines, produce audit evidence, reduce configuration drift, and demonstrate that governance and risk management duties are implemented consistently.

Understanding CIS Microsoft SQL Server 2022 Benchmark v1.2.1

The CIS Microsoft SQL Server 2022 Benchmark v1.2.1 provides prescriptive guidance for the secure configuration of SQL Server 2022 on Microsoft Windows. It is intended for database and system administrators, security specialists, auditors, and deployment personnel responsible for developing, assessing, or securing SQL Server environments.

The benchmark covers installation and patching, attack surface reduction, authentication and authorization, password policies, auditing and logging, application development, and encryption. Greenbone’s compliance scan for CIS Microsoft SQL Server 2022 Benchmark v1.2.1 covers the practical Level 1 profile for the SQL Server Database Engine and AWS RDS, and the Level 2 Database Engine profile with additional defense-in-depth controls.

Understanding CIS Microsoft Windows Server 2025 Benchmark v2.0.0

The CIS Microsoft Windows Server 2025 Benchmark v2.0.0 audits security controls for establishing a hardened configuration of Windows Server 2025. It is designed for Active Directory domain-joined and Entra Hybrid-joined systems that receive policies through Active Directory Group Policy Manager. The policy is not designed for standalone, workgroup, cloud-managed, or cloud-hosted systems.

The benchmark addresses areas such as account and local security policies, system services, Windows Defender Firewall, advanced audit configuration, authentication, remote access, and administrative template settings. Greenbone’s compliance scan for CIS Microsoft Windows Server 2025 Benchmark v2.0.0 covers Level 1 and Level 2 profiles for both Domain Controllers and Member Servers, along with optional Next Generation Windows Security profiles for advanced controls.

Understanding CIS Microsoft Windows Server 2022 Benchmark v5.0.0

The CIS Microsoft Windows Server 2022 Benchmark v5.0.0 audits security controls for establishing a hardened configuration of Windows Server 2022. The Windows Server 2022 benchmark is intended for Active Directory domain-joined and Entra Hybrid-joined systems that receive policies through Active Directory Group Policy Manager. The policy is not designed for standalone, workgroup, cloud-managed, or cloud-hosted systems.

The benchmark addresses areas such as account and local security policies, system services, Windows Defender Firewall, advanced auditing, authentication, remote access, and administrative template settings. Greenbone’s compliance scan for CIS Microsoft Windows Server 2022 Benchmark v5.0.0 covers Level 1 and Level 2 profiles for Domain Controllers and Member Servers, along with optional Next Generation Windows Security profiles containing advanced controls.

Get to Know Greenbone’s Full Suite of Compliance Scans

OPENVAS SCAN’s compliance policies consist of specially selected groups of vulnerability tests used to assess compliance. Whether your organization is required to meet BSI technical standards or simply wants deeper insight into building resilient IT networks and applications, OPENVAS SCAN provides compliance visibility to identify gaps and strengthen security.

Some of the compliance scans in Greenbone’s OPENVAS ENTERPRISE FEED:

• BSI TR-03116-4: BSI Minimum Standards for the Use of TLS
• BSI TR-02102-4: BSI Minimum Standards for the Use of SSH
• CIS Benchmark v1.10 for Kubernetes 1.28 Controller Node
• CIS Benchmark v1.10 for Kubernetes 1.28 Worker Nodes
• Compliance profiles for Huawei EulerOS, openEuler, and Huawei Cloud EulerOS
• CIS Benchmark v3.0.0 (L1) for Microsoft Windows 11 Enterprise
• CIS Benchmarks v3.0.0 (L1 – Windows) for Google Chrome
• BSI and CIS Benchmarks for Microsoft Office
• Policy check for SSH: Post Quantum Cryptography (PQC)
• Policy check for SSL/TLS: Post Quantum Cryptography (PQC)

Summary

Microsoft platforms support critical business operations, but their extensive configuration options can introduce security gaps when systems are not consistently hardened. CIS Benchmarks are the IT industry standard for practical guidance on establishing secure configurations. Greenbone’s growing list of compliance scans helps organizations identify deviations from these recommended baselines, strengthen governance and audit readiness, and reduce configuration-related risk.

OPENVAS SCAN provides the visibility needed to maintain more resilient Microsoft environments as regulatory and operational security expectations continue to increase. Grabbing a copy of OPENVAS SCAN with a free two-week trial of the OPENVAS ENTERPRISE FEED is a surefire way for your organization to gain the deepest insight into building resilient IT networks and applications.

In July 2026, Zimbra released two security patches for multiple vulnerabilities affecting the Classic Web Client and other components of Zimbra Collaboration Suite (ZCS). Version 10.1.19 addressed a stored cross-site scripting (XSS) flaw that has not been assigned a CVE. Version 10.1.20 fixed a command-injection issue in the SNMP monitoring component, four additional stored XSS issues in the Classic Web Client, and numerous other flaws.

None of the new vulnerabilities are yet reported as actively exploited, and proof-of-concept (PoC) exploits are not publicly available. However, Zimbra has been a hot target for nation-state exploit campaigns in the past. Previous ZCS flaws have appeared 18 times on CISA’s KEV list. Five of those KEV listed CVEs are associated with ransomware attacks. In July 2026, U.S. and allied security agencies warned that the Russian state-backed group LAUNDRY BEAR has been exploiting ZCS vulnerabilities since at least July 2025[1][2].

Most of the security issues described in the 10.1.19 and 10.1.20 updates are not associated with a CVE. However, the pathway to mitigation is clear — users must update to the most recent version of Zimbra Collaboration Suite (ZCS) for protection. The OPENVAS ENTERPRISE FEED includes separate remote banner version checks to identify instances missing the 10.1.19 and 10.1.20 patches [1][2]. Users should upgrade to ZCS 10.1.20 as soon as possible.

A Risk Assessment of Zimbra Collaboration Suite Vulnerabilities

For organizations still using the Classic Web Client, the new flaws present significant risk. The 10.1.19 update addresses a stored XSS issue that can be triggered when a user opens a specially crafted email. The vulnerability has not been associated with a published CVE as of July 27th, 2026, but Zimbra has declared it a critical severity issue. Successful exploitation could expose mailbox information, session data, or account settings, potentially enabling account compromise and data theft.

The 10.1.20 patch addresses four additional stored XSS issues in the Classic Web Client, a command-injection vulnerability in the SNMP component, and flaws affecting mail forwarding restrictions, Exchange Web Services (EWS) access controls, mailbox delegation, and the Zimbra integration for Nextcloud.

Details of New Security Issues Impacting ZCS

Technical details for the security issues disclosed in both the ZCS 10.1.19 and 10.1.20 updates are limited. Also, CVEs have not been published for many of the described flaws.

Fixed in ZCS 10.1.19 (Released on July 7th, 2026):

• Classic Web Client stored XSS fixed in 10.1.19 (no CVE assigned): The flaw can be triggered by opening a specially crafted email. Exploitation allows an attacker to execute a malicious script in a user session and potentially expose mailbox information, session data, or account settings.

Fixed in ZCS 10.1.20 (Released on July 20th, 2026):

• SNMP monitoring (no CVE assigned): A command-injection vulnerability in the SNMP monitoring component when SNMP notifications are enabled.
• Classic Web Client stored XSS issues (no CVE assigned): Attachment filenames, crafted fields, and attachments can be designed to to trigger XSS on user’s systems when they view a malicious email.
• CVE-2026-50055 (CVE reserved but not published): A mail-forwarding restriction bypass could allow authenticated users to exfiltrate email despite forwarding restrictions being enabled.
• CVE-2026-10631 (CVE reserved but not published): An Exchange Web Services extension access-controls issue can have an undisclosed impact related to access controls.
• CVE-2026-50054 (CVE reserved but not published): A mailbox delegation authorization issue with undisclosed details.
• Nextcloud integration SSRF (no CVE assigned): A Server Side Request Forgery (SSRF) vulnerability in the Nextcloud integration for ZCS.

Mitigation for New Vulnerabilities in Zimbra Collaboration Suite

Users who have deployed the Classic Web Client should upgrade to ZCS v10.1.20 as soon as possible due to the risk of attacker-controlled XSS. The vendor has not described any workarounds. The OPENVAS ENTERPRISE FEED includes separate remote banner version checks to uncover instances missing the 10.1.19 and 10.1.20 patches [1][2].

Summary

Zimbra addressed multiple security issues in July 2026, issuing two security patches for ZCS. The updates address flaws in multiple components. The most critical issues are session-level XSS risk in the Classic Web Client. Other high-risk vulnerabilities include configuration-dependent command injection in SNMP monitoring and access-control or authorization weaknesses that can affect email exposure and delegated access. No active exploitation has been reported, although ZCS has been targeted by Advanced Persistent Threat (APT) actors in the past and is reportedly still an active target.

Januscape, tracked as CVE-2026-53359 (CVSS 8.8), is a use-after-free vulnerability [CWE-825] in the Linux kernel KVM/x86 that can let a guest crash its host and potentially break guest-host isolation. The highest-risk targets are Intel and AMD x86_64 KVM hosts that expose nested virtualization, especially in environments that accept untrusted guests or allow users to create virtual machines. Large global data center operators worldwide now face the complex task of patching vast fleets of KVM hosts while minimizing disruption to customer workloads.

Active exploitation of CVE-2026-53359 has not yet been reported. The vulnerabilities original reporter, Hyunwoo Kim, claims that the bug was used as a zero-day in Google’s kvmCTF and has released a PoC capable of causing Denial of Service (DoS) of all VMs running on the host from within a single guest VM. Detailed technical analysis have also been published [1][2]. Numerous national CERT agencies have issued alerts indicating high global risk [3][4][5][6][7][8][9][10][11][12][13][14][15][16].

Greenbone’s OPENVAS ENTERPRISE FEED includes detection for CVE-2026-53359 on Red Hat Enterprise Linux (RHEL), SUSE and openSUSE, AlmaLinux, Oracle Linux, Rocky Linux, Fedora, and Debian. Greenbone will continue to add vulnerability detection as more Linux distributions issue security advisories. Grabbing a copy of OPENVAS SCAN with a free two-week trial of the OPENVAS ENTERPRISE FEED is a surefire way to gain the deepest insight into where software vulnerabilities exist in your organization’s IT infrastructure.

A Global Risk Assessment of CVE-2026-53359 (Januscape)

According to the original public disclosure, the flaw has existed for roughly 16 years. Furthermore, all x86 Linux distributions and kernels prior to the fix commit are affected. This means the scope of affected IT infrastructure is very broad, presenting significant global risk. Successful exploitation can result in guest-to-host escape, corruption of the host kernel’s shadow page, DoS, and potentially, compromise of other guest VMs on the same host. For global data center operators, that scope translates into the same challenge repeated across every site: rolling out patches to thousands of KVM hosts without knocking customer workloads offline.

According to a post on Ubuntu’s blog, the primary public PoC effectively demonstrates that a guest VM can crash its hypervisor host. Furthermore, the original report says CVE-2026-53359 was used as a zero-day exploit in the Google kvmCTF.

The Technical Assessment of CVE-2026-53359 (Januscape)

CVE-2026-53359 (CVSS 8.8) affects KVM nested virtualization on Intel and AMD x86_64 systems, while other architectures are not affected. If a cloud provider does not allow nested virtualization, instances are not affected through this path. However, nested virtualization is enabled by default in the Linux kernel. Successful exploitation allows guest-to-host escape, corruption of the host kernel’s shadow page, DoS, and compromise of other VM guests running on the same host.

Ubuntu’s blog notes that system services such as libvirt, lxd, multipass, and incus may allow potential attackers to create virtual machines, which can affect exposure. A separate risk path exists where /dev/kvm permissions are overly broad; if /dev/kvm is world-writable, an unprivileged user can achieve local privilege escalation to gain root-level privileges.

CVE-2026-53359 is a use-after-free in shadow MMU emulation caused by shadow-page reuse when the page role does not match the new use. The affected component is the Linux kernel KVM/x86 shadow paging path in arch/x86/kvm/mmu/mmu.c. The root cause is that the kvm_mmu_get_child_sp() function does not compare roles effectively. The mismatch can leave a stale rmap entry, leading to an exploitable pointer de-reference [CWE-825].

Products Affected by CVE-2026-53359 (Januscape)

All x86 Linux distributions after roughly 2014 and prior to the Linux kernel fix commit are affected, regardless of distribution. Because CVE-2026-53359 is a guest-to-host escape vulnerability, exploitation depends on the the target system being used as a KVM-based hypervisor and having nested virtualization enabled on a guest VM.

For Ubuntu environments, defenders should review Canonical’s Januscape mitigation guidance, which says all Ubuntu releases from Trusty (14.04) through Resolute (26.04) are are affected. While patches for Ubuntu are still pending, instructions for disabling nested virtualization are provided. For Red Hat environments, teams should compare deployed kernels against the fixed builds listed in Red Hat’s security data entry.

Mitigation for CVE-2026-53359 (aka Januscape)

Complete mitigation depends on installing the security updates for the specific Linux distribution. Prioritized mitigation should begin with identifying where nested virtualization is exposed on Linux KVM/x86 hypervisors, especially in multi-tenant environments or deployments that allow untrusted users to create or control guest VMs. Because exploitation may depend on guest control or access to virtualization interfaces, defenders should also review who can create VMs and whether device-node permissions around /dev/kvm expose an additional local privilege escalation path.

Summary

CVE-2026-53359 (aka Januscape; CVSS 8.8) is a high-impact virtualization-boundary vulnerability caused by a use-after-free flaw on Intel and AMD x86_64 Linux KVM deployments with nested virtualization enabled in the Linux kernel. The consequences include guest-to-host escape, and possible compromise of other guest VMs on the same host. At least one public proof-of-concept is available along with detailed technical analysis [1][2]. Active exploitation is not yet confirmed, but the volume of national CERT advisories flagging the flaw as a high global risk tells its own story [3][4][5][6][7][8][9][10][11][12][13][14][15][16].

Detection is already available: Greenbone’s OPENVAS ENTERPRISE FEED covers CVE-2026-53359 across Red Hat Enterprise Linux (RHEL), SUSE and openSUSE, AlmaLinux, Oracle Linux, Rocky Linux, Fedora, and Debian, with more distributions being added as their advisories land. A free two-week trial of OPENVAS SCAN with the OPENVAS ENTERPRISE FEED is the fastest way to see exactly where this vulnerability sits in your organization’s infrastructure.

Technical guidelines published by government bodies define the highest security standards for protecting the national IT infrastructure. As the cyber security landscape becomes more perilous, it’s even more important for organizations to be diligent about implementing the strictest security standards. Government organizations need to ensure compliance, while private-sector entities can use the standards as benchmarks for their own cyber resilience.

Greenbone is happy to announce updated compliance scans aligned with the German Federal Office for Information Security’s (BSI) minimum standards for hardening TLS and SSH. The policies identify specific TLS and SSH configuration gaps within portions of the respective guidance.

In this article, we review the TR-03116-4 and TR-02102-4 guidelines to understand what’s new. Grabbing a copy of OPENVAS SCAN with a free two-week trial of the OPENVAS ENTERPRISE FEED is a surefire way for your organization to gain the deepest insight into building resilient IT networks and applications.

The Transport Layer Security (TLS) and Secure Shell (SSH) protocols are among the most fundamental used in today’s networks. Greenbone now offers updated policy scans to measure compliance with selected portions of the BSI’s guidance. The updated guidance standards are:

• TR-03116-4 (July 2025): BSI Minimum Standard for the Use of Transport Layer Security (TLS)
• TR-02102-4 (January 2026): BSI Minimum Standard for the Use of Secure Shell (SSH)

These updates add to Greenbone’s already impressive line of compliance policies for OPENVAS SCAN. Although TR-03116-4 and TR-02102-4 do not yet include post-quantum cryptography guidelines, standards for assessing PQC-compliant systems are under development. Greenbone has helped lead the way. Our OPENVAS ENTERPRISE FEED features PQC compliance scans for both TLS and SSH:

• SSL/TLS: Post Quantum Cryptography (PQC) Policy Check
• SSH: Post Quantum Cryptography (PQC) Policy Check

Understanding TR-03116-4 BSI Minimum Standards for the Use of TLS

Part 4 of the TR-03116 series of technical guidelines specifies requirements and recommendations for the use of TLS in federal government applications. TR-03116-4 builds on earlier releases in the series. The standard is generally valid until the end of 2030, although specific timelines for deprecating or implementing certain methods are included. Greenbone’s policy covers selected portions of TR-03116-4; using remote TLS handshakes, the compliance scan assesses selected Chapter 2 controls, including:

• Supported and minimum allowed TLS versions
• Configured TLS 1.2 and TLS 1.3 cipher suites against policy allow lists
• Presence of at least one BSI-mandated cipher suite supported by the server

Other vulnerability tests in the OPENVAS ENTERPRISE FEED separately identify additional risks posed by the remaining guidance areas. Examples include known SAML authentication and XML-signature vulnerabilities, vulnerable S/MIME/CMS implementations in OpenSSL or mail products, and OpenPGP/PGP software detection and product vulnerabilities.

Understanding TR-02102-4 BSI Minimum Standards for the Use of SSH

Part 4 of the BSI’s TR-02102 guideline series specifies the recommended SSH protocol versions, cryptographic algorithms, and key lengths for use in federal government applications. Like TR-03116-4 described above, TR-02102-4 builds on earlier guidance in its series, specifically TR-02102-1.

The Greenbone’s new compliance scans verify selected values read from the SSH server configuration, including:

• SSH protocol version, allowed key-exchanges, encryption algorithms, MAC, host-key algorithms, and rekey limit
• Client authentication requirements through AuthenticationMethods or RequiredAuthentications, and PubkeyAuthentication

These authenticated configuration checks provide useful technical evidence, but do not test live authentication behavior or assess client application risks, side channel attacks, implementation flaws, or operational controls associated with all SSH use-cases.

Post Quantum Compliance with Greenbone

Neither TR-03116-4 nor TR-02102-4 define compliance standards for Post Quantum Cryptography (PQC). However, they advise that organizations should prepare now to migrate from classical asymmetric cryptography to quantum-safe cryptography, beginning with hybrid schemes that combine classical and quantum-safe algorithms. Organizations seeking to assess their PQC resilience today can use Greenbone’s existing PQC policy scans:

• SSL/TLS: Post Quantum Cryptography (PQC) Policy Check
• SSH: Post Quantum Cryptography (PQC) Policy Check

Get to Know Greenbone’s Full Suite of Compliance Scans

OPENVAS SCAN’s compliance policies consist of specially selected groups of vulnerability tests used to assess compliance. Whether your organization is required to meet BSI technical standards or you simply want deeper insight into building resilient IT networks and applications, OPENVAS SCAN provides compliance visibility to identify gaps and strengthen security.

Some of the compliance scans in Greenbone’s OPENVAS ENTERPRISE FEED:

• CIS Benchmark for Microsoft SQL Server 2022
• CIS Benchmark v5.0.0 for Microsoft Windows Server 2022
• CIS Benchmark v2.0.0 for Microsoft Windows Server 2025
• CIS Benchmark v1.10 for Kubernetes 1.28 Controller Node
• CIS Benchmark v1.10 for Kubernetes 1.28 Worker Nodes
• Compliance profiles for Huawei EulerOS, openEuler, and Huawei Cloud EulerOS
• CIS Benchmark v3.0.0 (L1) for Microsoft Windows 11 Enterprise
• CIS Benchmarks v3.0.0 (L1 – Windows) for Google Chrome
• BSI and CIS Benchmarks for Microsoft Office
• Policy check for SSH: Post Quantum Cryptography (PQC)
• Policy check for SSL/TLS: Post Quantum Cryptography (PQC)

Summary

Germany’s BSI sets the technical requirements for federal government IT infrastructure. Other national governments around the world publish their own security forecasts and guidelines. While private institutions are not typically required to implement these guidelines, they offer reliable insight for implementing resilient IT architecture.

The Transport Layer Security (TLS) and Secure Shell (SSH) are two of the most fundamental protocols used in today’s IT networks. Greenbone is happy to announce updated compliance scans for selected portions of the BSI’s minimum standards for hardening TLS and SSH according to TR-03116-4 and TR-02102-4. Grabbing a copy of OPENVAS SCAN with a free two-week trial of the OPENVAS ENTERPRISE FEED is a surefire way for your organization to gain the deepest insight into building resilient IT networks and applications.

Citrix security advisory CTX696604 covers six vulnerabilities in customer-managed NetScaler ADC and NetScaler Gateway. NetScaler Gateway is used to authenticate remote users and connect them to internal network resources, and NetScaler ADC load balancing is a core feature used to distribute requests and improve availability. The highest-risk issues in the bulletin can lead to memory overread, denial of service (DoS), and arbitrary file read. However, specific configurations must be present for the flaws to be exploitable.

The bulletin applies only to customer-managed NetScaler ADC and NetScaler Gateway. Citrix cloud services have already been upgraded by Citrix. In some cases, exploitation requires specific deployments or enabled features, such as SAML IDP, Gateway services, AAA virtual server exposure, Oracle or DNS roles, management access on NSIP or SNIP, and protocol options attached to virtual servers or services.

There is no evidence of active exploitation for the CVEs included in the CTX696604 advisory, and no public proof-of-concept (PoC) exploits have been released. However the same affected products were actively exploited in March, 2026. In total, Citrix Netscaler has been added to CISA’s KEV list 22 times since late 2021, shockingly 7 times associated with ransomware attacks. Multiple national CERT alerts have been issued for the new CVEs, indicating a high level of global risk [1][2][3][4][5][6][7][8][9][10][11][12][13].

The OPENVAS ENTERPRISE FEED includes a remote banner check that identifies vulnerable NetScaler ADC and NetScaler Gateway installations affected by the CVEs in Citrix advisory CTX696604. Grabbing a copy of OPENVAS SCAN with a free two-week trial of the OPENVAS ENTERPRISE FEED is a surefire way to gain the deepest insight into where software vulnerabilities exist in your organization’s IT infrastructure.

Vulnerability Details for Citrix Bulletin CTX696604

The six CVEs in the bulletin can cause memory overread, DoS, and arbitrary file read. In each case, the vendor ties exploitability to a specific configuration, which narrows exposure but does not eliminate the need for patching. The most operationally sensitive issues are those that are unauthenticated and network-reachable.

CVE-2026-8452 and CVE-2026-8655 are both potentially high-impact, remotely exploitable flaws that do not require authentication. They both affect service endpoints that are typically unrestricted. CVE-2026-8451 can result in the disclosure of sensitive information that could be leveraged in subsequent attacks. While CVE-2026-10816 is also remotely exploitable without authentication, management access to the affected device must be enabled.

Affected Products and Versions

The advisory affects multiple customer-managed NetScaler product lines, including standard releases and FIPS or NDcPP builds. According to the vendor, Secure Private Access Hybrid deployments using NetScaler instances are also affected. The impact is configuration-dependent, so defenders should validate both version status and whether the listed services or profiles are enabled.

Mitigating Citrix NetScaler CVEs from Bulletin CTX696604

The fixed releases listed by the vendor in the table above provide the most effective remediation path. Organizations running affected devices should move to the corresponding fixed version for their release train. No workarounds are described in the vendor bulletin.

For CVE-2026-13474, the Cyber Security Agency of Singapore recommends setting the Http2SmallWndTimeout parameter to 30 seconds as an added mitigation. That guidance is specific to the HTTP/2-related issue and does not replace the vendor fix.

Defenders should check whether the affected features are enabled, because the vulnerable conditions depend on deployment state. Security teams should validate SAML IDP configurations; Gateway and AAA virtual servers; Oracle and DNS roles; management access exposure on NSIP or SNIP; TCP Timestamp settings in profiles; and HTTP/2 settings in HTTP profiles. Where those functions are not required, disabling them reduces exposure while patching is scheduled.

Summary

The Citrix CTX696604 advisory describes six NetScaler ADC and NetScaler Gateway vulnerabilities that affect customer-managed deployments and certain Secure Private Access Hybrid instances. The highest-risk CVEs are configuration-dependent. However, these include unauthenticated network-reachable impacts such as unexpected behavior, sensitive information disclosure, DoS, and arbitrary file read conditions. Available evidence does not indicate active exploitation or that a public PoC exists. However, multiple national CERT alerts have been issued for the CVEs [1][2][3][4][5][6][7][8][9][10][11][12][13].

Organizations should scan their infrastructure for affected appliances, confirm whether the vulnerable features are enabled, and apply the fixed releases for their product line without delay. The OPENVAS ENTERPRISE FEED includes a remote banner check to identify vulnerable NetScaler ADC and NetScaler Gateway installations affected by the CVEs discussed in Citrix advisory CTX696604. Grabbing a copy of OPENVAS SCAN with a free two-week trial of the OPENVAS ENTERPRISE FEED is a surefire way to gain the deepest insight into where software vulnerabilities exist in your organization’s IT infrastructure.