{"id":"CVE-2026-111337","kind":"vulnerability","aliases":["CVE-2026-111337"],"related":[],"title":"Citrix NetScaler: Base64 decoding overflow in policy expressions crashes or misbehaves","description":"Memory overflow in Base64 decoding in advanced policy expressions leading to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.","summary":"A memory overflow in how Citrix NetScaler ADC and NetScaler Gateway decode Base64 inside advanced policy expressions can cause erratic behavior or a denial of service. The sources do not state that an attacker can run code or read data.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NetScaler ADC","fixed":["14.1-73.57"],"affected":"< 14.1-73.57","ecosystem":"vendor"},{"name":"NetScaler Gateway","fixed":["14.1-73.57"],"affected":"< 14.1-73.57","ecosystem":"vendor"}],"ecosystems":[],"tags":["citrix","denial-of-service","infrastructure","netscaler","netscaler-gateway","self-hosted"],"not_affected_if":["no-appfw","no-b64decode-policy"],"how_to_check":"Exposed only if a policy containing the B64DECODE advanced-policy-expression operator is bound globally or to a virtual server of any type, and/or an Application Firewall (AppFW) is configured (Citrix's stated precondition). Search the running config (show running config) for B64DECODE and for AppFW bindings, and check the version with 'show version'. Citrix lists affected builds as before 14.1-73.57, 13.1-64.39, 14.1-FIPS 14.1-73.58, 13.1-FIPS/NDcPP 13.1-37.293 (taken from a mirror of the bulletin, not read on Citrix's page). Note the bulletin's ID for this row differs between renderings (CVE-2026-111337 vs CVE-2026-111347); the NVD id matches 111337.","fix":"Upgrade to NetScaler ADC/Gateway 14.1-73.57 or later (14.1); 13.1-64.39 or later (13.1); 14.1-FIPS 14.1-73.58 FIPS or later; 13.1-FIPS and 13.1-NDcPP 13.1-37.293 or later.","status":"open","published_at":"2026-11-13T08:17:15+00:00","first_seen_at":"2026-11-13T08:44:23+00:00","triaged_at":"2026-11-13T08:45:17+00:00","updated_at":"2026-11-13T08:47:13+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-13T08:45:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Citrix NetScaler: Base64 decoding overflow in policy expressions crashes or misbehaves","impact":"medium","summary":"A memory overflow in how Citrix NetScaler ADC and NetScaler Gateway decode Base64 inside advanced policy expressions can cause erratic behavior or a denial of service. The sources do not state that an attacker can run code or read data.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["citrix","netscaler","netscaler-gateway","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Appliance crashes or behaves unpredictably, causing denial of service","analyst_note":"Find the Citrix advisory for CVE-2026-111337 to confirm affected and fixed NetScaler versions, required policy configuration, and whether authentication is needed.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Citrix NetScaler ADC or NetScaler Gateway appliances that use advanced policy expressions are the ones to look at. The sources do not say which configurations trigger it or which versions are affected, so teams should confirm against the vendor advisory before deciding who can skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000716,"input_tokens":4530,"output_tokens":526,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Citrix advisory for CVE-2026-111337 to confirm affected and fixed NetScaler versions, required policy configuration, and whether authentication is needed.","search":"'-111337':14A,17A '-2026':13A,16A 'adc':19A,42B,97C 'advanc':49B,81C 'attack':68B 'base64':3A,47B,78C 'behavior':55B,89C 'caus':53B 'citrix':1A,22B,40B,95C,99C 'code':71B 'crash':9A 'cve':12A,15A 'data':74B 'decod':4A,46B,79C 'denial':24B,58B,91C 'denial-of-servic':23B 'errat':54B 'erron':88C 'express':8A,51B,83C 'gateway':21A,31B,45B,101C 'host':34B 'infrastructur':27B 'insid':48B 'lead':84C 'memori':36B,75C 'misbehav':11A 'netscal':2A,28B,30B,41B,44B,96C,100C 'netscaler':18A,20A 'netscaler-gateway':29B 'overflow':5A,37B,76C 'polici':7A,50B,82C 'read':73B 'run':70B 'self':33B 'self-host':32B 'servic':26B,60B,93C 'sourc':62B 'state':65B 'unpredict':86C","nicknames":[],"mitigations":[],"who_affected":"Self-managed NetScaler ADC and NetScaler Gateway appliances that have a policy using the B64DECODE operator bound globally or to any virtual server, and/or an Application Firewall configured. Citrix rates it a denial of service or erratic behavior from a heap overflow, network-reachable with no authentication or user interaction per the CVSS v4 vector; it does not state code execution. Appliances without B64DECODE policies or AppFW can skip this one, but the same bulletin covers about 28 other CVEs, some in default config.","tier":"B","verified":{"fix":{"at":"2026-11-13T08:47:13Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3838}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adc","gateway","netscaleradc","netscalergateway"],"ptokens":["adc","gateway","netscaler"],"labels":["citrix","denialofservice","high","infrastructure","netscaler","netscalergateway","selfhosted"],"campaign_type":null,"search_a":"'-111337':14A,17A '-2026':13A,16A 'adc':19A 'base64':3A 'citrix':1A 'crash':9A 'cve':12A,15A 'decod':4A 'express':8A 'gateway':21A 'misbehav':11A 'netscal':2A 'netscaler':18A,20A 'overflow':5A 'polici':7A","search_b":"'adc':42B 'advanc':49B 'attack':68B 'base64':47B 'behavior':55B 'caus':53B 'citrix':22B,40B 'code':71B 'data':74B 'decod':46B 'denial':24B,58B 'denial-of-servic':23B 'errat':54B 'express':51B 'gateway':31B,45B 'host':34B 'infrastructur':27B 'insid':48B 'memori':36B 'netscal':28B,30B,41B,44B 'netscaler-gateway':29B 'overflow':37B 'polici':50B 'read':73B 'run':70B 'self':33B 'self-host':32B 'servic':26B,60B 'sourc':62B 'state':65B","search_c":"'adc':97C 'advanc':81C 'base64':78C 'behavior':89C 'citrix':95C,99C 'decod':79C 'denial':91C 'erron':88C 'express':83C 'gateway':101C 'lead':84C 'memori':75C 'netscal':96C,100C 'overflow':76C 'polici':82C 'servic':93C 'unpredict':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T08:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111337","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111337","severity":null,"published_at":"2026-11-13T08:17:15+00:00","modified_at":"2026-11-13T08:17:15+00:00","first_seen_at":"2026-11-13T08:44:23+00:00","fetched_at":"2026-11-13T08:44:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111337:3838","url":"https://support.citrix.com/external/article/CTX697305","severity":null,"published_at":"2026-11-13T08:47:13+00:00","modified_at":"2026-11-13T08:47:13+00:00","first_seen_at":"2026-11-13T08:47:13+00:00","fetched_at":"2026-11-13T08:47:13+00:00","note":"Citrix CTX697305 read: precondition B64DECODE policy bound and/or AppFW, heap overflow CWE-122, CVSS4 8.7, fixed builds listed. Affected-range lower bounds (13.1 < 13.1-64.39 etc.) from mirror only; 13.1 and FIPS rows not stored as products. Row ID differs between two fetches of the bulletin (111337 vs 111347); check against the live page. No exploitation or PoC found; X/social not searched. Only the fix field marked verified.","cites":["https://support.citrix.com/external/article/CTX697305"]}],"documents":[{"id":142058,"url":"https://support.citrix.com/external/article/CTX697305","title":"Citrix NetScaler ADC and Gateway Security Bulletin CTX697305","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}