{"id":"CVE-2026-111334","kind":"vulnerability","aliases":["CVE-2026-111334"],"related":[],"title":"Citrix NetScaler ADC and Gateway: memory overflow in Endpoint Analysis (EPA/EPAS) can cause erroneous behavior or denial of service","description":"Memory overflow in Endpoint Analysis (EPA/EPAS) can lead to unpredictable or erroneous behavior or a Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.","summary":"A memory overflow in Endpoint Analysis (EPA/EPAS) in Citrix NetScaler ADC and NetScaler Gateway can cause unpredictable or erroneous behavior, or a denial of service. The sources do not state that an attacker can run code or read data from this flaw.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NetScaler ADC","fixed":["14.1-73.57"],"affected":"< 14.1-73.57","ecosystem":"vendor"},{"name":"NetScaler Gateway","fixed":["14.1-73.57"],"affected":"< 14.1-73.57","ecosystem":"vendor"}],"ecosystems":[],"tags":["citrix","endpoint-analysis","infrastructure","netscaler","netscaler-gateway","self-hosted","vpn"],"not_affected_if":["citrix-managed-cloud","no-epa-configured"],"how_to_check":"- Run show ns version; you are in range if it is below 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS or 13.1-37.293 (FIPS/NDcPP).\n- Citrix's precondition: the appliance is a VPN virtual server or an authentication (AAA) virtual server with Endpoint Analysis. Look in ns.conf for 'add authentication epaAction', 'add aaa preauthenticationpolicy', or clientSecurity in the VPN parameter or session action (check commands per fetched bulletin summary; the bulletin's own steps section was cut off in my read).\n- Secure Private Access Hybrid deployments using NetScaler instances are also affected.","fix":"Upgrade to 14.1-73.57 or later (14.1); 13.1-64.39 or later (13.1); 14.1-73.58 FIPS or later (14.1-FIPS); 13.1-37.293 or later (13.1-FIPS and 13.1-NDcPP). Citrix lists no workaround.","status":"open","published_at":"2026-11-13T08:17:15+00:00","first_seen_at":"2026-11-13T08:44:23+00:00","triaged_at":"2026-11-13T08:45:13+00:00","updated_at":"2026-11-13T08:46:25+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-13T08:45:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Citrix NetScaler: memory overflow in Endpoint Analysis can crash or misbehave","impact":"medium","summary":"A memory overflow in Endpoint Analysis (EPA/EPAS) in Citrix NetScaler ADC and NetScaler Gateway can cause unpredictable or erroneous behavior, or a denial of service. The sources do not state that an attacker can run code or read data from this flaw.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["citrix","netscaler","netscaler-gateway","endpoint-analysis"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Denial of service or unpredictable behavior on the gateway","analyst_note":"Check the Citrix security bulletin for affected and fixed NetScaler versions, the EPA/EPAS trigger conditions and the CVSS 9.3 vector; NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-111334","how_to_check":"- Check the NetScaler ADC and NetScaler Gateway firmware version against the affected ranges in the Citrix advisory, unknown from these sources\n- Check whether Endpoint Analysis (EPA/EPAS) scanning is enabled on the gateway, unknown from these sources","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organisations running Citrix NetScaler ADC or NetScaler Gateway with Endpoint Analysis enabled are the likely exposure, since the flaw sits in the EPA/EPAS component. The sources do not give the affected versions or whether a default configuration is affected. unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000788,"input_tokens":4545,"output_tokens":667,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the Citrix security bulletin for affected and fixed NetScaler versions, the EPA/EPAS trigger conditions and the CVSS 9.3 vector; NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-111334","search":"'-111334':22A,25A '-2026':21A,24A 'adc':3A,27A,53B,106C 'analysi':10A,33B,48B,89C 'attack':75B 'behavior':15A,62B,97C 'caus':13A,58B 'citrix':1A,30B,51B,104C,108C 'code':78B 'cve':20A,23A 'data':81B 'denial':17A,65B,100C 'endpoint':9A,32B,47B,88C 'endpoint-analysi':31B 'epa/epas':11A,49B,90C 'erron':14A,61B,96C 'flaw':84B 'gateway':5A,29A,38B,56B,110C 'host':41B 'infrastructur':34B 'lead':92C 'memori':6A,44B,85C 'netscal':2A,35B,37B,52B,55B,105C,109C 'netscaler':26A,28A 'netscaler-gateway':36B 'overflow':7A,45B,86C 'read':80B 'run':77B 'self':40B 'self-host':39B 'servic':19A,67B,102C 'sourc':69B 'state':72B 'unpredict':59B,94C 'vpn':42B","nicknames":[],"mitigations":[],"who_affected":"Customer-managed NetScaler ADC and NetScaler Gateway appliances in the affected builds that run as a VPN or AAA virtual server with Endpoint Analysis (EPA) enabled. Citrix-managed cloud services and Adaptive Authentication are upgraded by Cloud Software Group. Appliances without EPA configured do not meet Citrix's stated precondition.","tier":"B","verified":{"fix":{"at":"2026-11-13T08:46:25Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3833}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adc","gateway","netscaleradc","netscalergateway"],"ptokens":["adc","gateway","netscaler"],"labels":["citrix","critical","endpointanalysis","infrastructure","netscaler","netscalergateway","selfhosted","vpn"],"campaign_type":null,"search_a":"'-111334':22A,25A '-2026':21A,24A 'adc':3A,27A 'analysi':10A 'behavior':15A 'caus':13A 'citrix':1A 'cve':20A,23A 'denial':17A 'endpoint':9A 'epa/epas':11A 'erron':14A 'gateway':5A,29A 'memori':6A 'netscal':2A 'netscaler':26A,28A 'overflow':7A 'servic':19A","search_b":"'adc':53B 'analysi':33B,48B 'attack':75B 'behavior':62B 'caus':58B 'citrix':30B,51B 'code':78B 'data':81B 'denial':65B 'endpoint':32B,47B 'endpoint-analysi':31B 'epa/epas':49B 'erron':61B 'flaw':84B 'gateway':38B,56B 'host':41B 'infrastructur':34B 'memori':44B 'netscal':35B,37B,52B,55B 'netscaler-gateway':36B 'overflow':45B 'read':80B 'run':77B 'self':40B 'self-host':39B 'servic':67B 'sourc':69B 'state':72B 'unpredict':59B 'vpn':42B","search_c":"'adc':106C 'analysi':89C 'behavior':97C 'citrix':104C,108C 'denial':100C 'endpoint':88C 'epa/epas':90C 'erron':96C 'gateway':110C 'lead':92C 'memori':85C 'netscal':105C,109C 'overflow':86C 'servic':102C 'unpredict':94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T08:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111334","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111334","severity":null,"published_at":"2026-11-13T08:17:15+00:00","modified_at":"2026-11-13T08:17:15+00:00","first_seen_at":"2026-11-13T08:44:23+00:00","fetched_at":"2026-11-13T08:44:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111334:3833","url":"https://support.citrix.com/external/article/CTX697305","severity":null,"published_at":"2026-11-13T08:46:25+00:00","modified_at":"2026-11-13T08:46:25+00:00","first_seen_at":"2026-11-13T08:46:25+00:00","fetched_at":"2026-11-13T08:46:25+00:00","note":"Read Citrix bulletin CTX697305 (fixed builds, EPA precondition: VPN/AAA vserver with EPA; no workaround). Caveats: bulletin page text dropped the CVE id on the EPA row and a mirror (axacom) labels that row CVE-2026-111344; NVD ties 111334 to CTX697305 with the same versions, so possible id typo, unconfirmed. 13.1 and FIPS ranges are in fix text only, not product rows. No exploitation or PoC seen; description says DoS/erroneous behavior, though CVSS vector has high C/I/A. Sibling CVE-2026-120868 (default config) is the more urgent one. Web search worked; X not checked.","cites":["https://support.citrix.com/external/article/CTX697305","https://www.heise.de/en/news/Attackers-can-take-Citrix-NetScaler-ADC-and-NetScaler-Gateway-offline-11523095.html"]}],"documents":[{"id":142058,"url":"https://support.citrix.com/external/article/CTX697305","title":"Citrix NetScaler ADC and Gateway Security Bulletin CTX697305","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":142059,"url":"https://www.heise.de/en/news/Attackers-can-take-Citrix-NetScaler-ADC-and-NetScaler-Gateway-offline-11523095.html","title":"heise: Attackers can take Citrix NetScaler ADC and Gateway offline","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}