NETSCALER ADC · CVE-2026-111337 · Infrastructure
FIX → 14.1-73.57 ✓ verified
A memory overflow in how Citrix NetScaler ADC and NetScaler Gateway decode Base64 inside advanced policy expressions can cause erratic behavior or a denial of service. The sources do not state that an attacker can run code or read data.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-managed NetScaler ADC and NetScaler Gateway appliances that have a policy using the B64DECODE operator bound globally or to any virtual server, and/or an Application Firewall configured. Citrix rates it a denial of service or erratic behavior from a heap overflow, network-reachable with no authentication or user interaction per the CVSS v4 vector; it does not state code execution. Appliances without B64DECODE policies or AppFW can skip this one, but the same bulletin covers about 28 other CVEs, some in default config.
Not affected if no-appfw, no-b64decode-policy
Who cares citrix, denial-of-service, netscaler, netscaler-gateway, self-hosted
show versionMemory overflow in Base64 decoding in advanced policy expressions leading to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 14.1-73.57
Upgrade to NetScaler ADC/Gateway 14.1-73.57 or later (14.1); 13.1-64.39 or later (13.1); 14.1-FIPS 14.1-73.58 FIPS or later; 13.1-FIPS and 13.1-NDcPP 13.1-37.293 or later.