{"id":"CVE-2026-111340","kind":"vulnerability","aliases":["CVE-2026-111340"],"related":[],"title":"Citrix NetScaler: memory overflow in KBA authentication enables denial of service","description":"Memory overflow in KBA (knowledge-based authentication) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.","summary":"A stack-based buffer overflow (CWE-121) in NetScaler's knowledge-based authentication (KBA) can cause unpredictable behavior or denial of service. Citrix rates it CVSS v4 8.7 with no authentication or user interaction needed (AV:N/PR:N); the impact scored is availability only. It applies only if the appliance has an LDAP action with KBAttribute or an Email action configured. The bulletin does not report exploitation.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NetScaler ADC","fixed":["14.1-73.57"],"affected":"< 14.1-73.57","ecosystem":"vendor"},{"name":"NetScaler Gateway","fixed":["14.1-73.57"],"affected":"< 14.1-73.57","ecosystem":"vendor"},{"name":"NetScaler ADC 13.1","fixed":["13.1-64.39"],"affected":"< 13.1-64.39","ecosystem":"vendor"},{"name":"NetScaler Gateway 13.1","fixed":["13.1-64.39"],"affected":"< 13.1-64.39","ecosystem":"vendor"},{"name":"NetScaler ADC 14.1-FIPS","fixed":["14.1-73.58"],"affected":"< 14.1-73.58","ecosystem":"vendor"},{"name":"NetScaler ADC 13.1-FIPS/NDcPP","fixed":["13.1-37.293"],"affected":"< 13.1-37.293","ecosystem":"vendor"}],"ecosystems":[],"tags":["authentication","citrix","denial-of-service","gateway","infrastructure","netscaler","self-hosted"],"not_affected_if":["no-email-action","no-kba-ldap-action","no-netscaler"],"how_to_check":"Search the NetScaler running config for lines matching 'add authentication ldapAction .* -KBAttribute .*' or 'add authentication emailAction .*'. If neither exists, the precondition is not met. Then check the firmware version (show ns version) against: 14.1 before 14.1-73.57, 13.1 before 13.1-64.39, 14.1-FIPS before 14.1-73.58, 13.1-FIPS/NDcPP before 13.1-37.293.","fix":"Upgrade to 14.1-73.57 or later, 13.1-64.39 or later 13.1, 14.1-FIPS 14.1-73.58 or later, or 13.1-FIPS/13.1-NDcPP 13.1-37.293 or later. Citrix lists no workaround or mitigation.","status":"open","published_at":"2026-11-13T04:17:36+00:00","first_seen_at":"2026-11-13T04:42:39+00:00","triaged_at":"2026-11-13T04:43:50+00:00","updated_at":"2026-11-13T04:45:16+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-13T04:43:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Citrix NetScaler: memory overflow in KBA authentication enables denial of service","impact":"medium","summary":"A memory overflow in the knowledge-based authentication (KBA) feature of Citrix NetScaler ADC and NetScaler Gateway can cause unpredictable behavior or a denial of service. The sources do not state that code execution or data theft is possible.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["netscaler","citrix","self-hosted","gateway"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Appliance behaves erratically or crashes, causing denial of service","analyst_note":"Find the Citrix advisory for CVE-2026-111340 to get affected and fixed versions, whether KBA must be enabled, and whether the attack is unauthenticated.","how_to_check":"- Check whether KBA authentication is configured on NetScaler ADC or NetScaler Gateway appliances\n- Confirm the running firmware version on each appliance against the vendor's advisory: unknown\n- The sources do not describe a specific setting or command to confirm exposure","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-netscaler"],"who_is_affected":"NetScaler ADC and NetScaler Gateway deployments are the affected products named in the description. The sources do not specify which versions or which KBA configurations are exposed, so teams running these appliances should check the vendor advisory. Teams without NetScaler appliances can skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000747,"input_tokens":4532,"output_tokens":587,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Citrix advisory for CVE-2026-111340 to get affected and fixed versions, whether KBA must be enabled, and whether the attack is unauthenticated.","search":"'-111340':14A,17A '-121':55B '-2026':13A,16A '13.1':24A,27A,34A '14.1':30A '8.7':77B 'action':103B,109B 'adc':19A,23A,29A,33A,139C 'appli':95B 'applianc':99B 'authent':7A,36B,62B,80B,124C 'av':85B 'avail':92B 'base':51B,61B,123C 'behavior':67B,131C 'buffer':52B 'bulletin':112B 'caus':65B 'citrix':1A,37B,72B,137C,141C 'configur':110B 'cve':12A,15A 'cvss':75B 'cwe':54B 'denial':9A,39B,69B,133C 'denial-of-servic':38B 'email':108B 'enabl':8A 'erron':130C 'exploit':116B 'fips':31A 'fips/ndcpp':35A 'gateway':21A,26A,42B,143C 'host':47B 'impact':89B 'infrastructur':43B 'interact':83B 'kba':6A,63B,120C 'kbattribut':105B 'knowledg':60B,122C 'knowledge-bas':59B,121C 'ldap':102B 'lead':126C 'memori':3A,117C 'n':87B 'n/pr':86B 'need':84B 'netscal':2A,44B,57B,138C,142C 'netscaler':18A,20A,22A,25A,28A,32A 'overflow':4A,53B,118C 'rate':73B 'report':115B 'score':90B 'self':46B 'self-host':45B 'servic':11A,41B,71B,135C 'stack':50B 'stack-bas':49B 'unpredict':66B,128C 'user':82B 'v4':76B","nicknames":[],"mitigations":[],"who_affected":"Self-managed NetScaler ADC and NetScaler Gateway appliances that have an LDAP authentication action with KBAttribute or an email action configured, on 14.1 or 13.1 builds before the fixed ones. The attack is network-reachable and unauthenticated per Citrix's CVSS vector, and the result is a crash or denial of service. Appliances with neither configuration entry meet no precondition for this CVE.","tier":"B","verified":{"fix":{"at":"2026-11-13T04:45:16Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3820},"products":{"at":"2026-11-13T04:45:16Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3820},"mitigations":{"at":"2026-11-13T04:45:16Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3820},"how_to_check":{"at":"2026-11-13T04:45:16Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3820},"who_affected":{"at":"2026-11-13T04:45:16Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3820}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adc","adc131","adc131fipsndcpp","adc141fips","gateway","gateway131","netscaleradc","netscaleradc131","netscaleradc131fipsndcpp","netscaleradc141fips","netscalergateway","netscalergateway131"],"ptokens":["13","14","adc","fips","gateway","ndcpp","netscaler"],"labels":["authentication","citrix","denialofservice","gateway","high","infrastructure","netscaler","selfhosted"],"campaign_type":null,"search_a":"'-111340':14A,17A '-2026':13A,16A '13.1':24A,27A,34A '14.1':30A 'adc':19A,23A,29A,33A 'authent':7A 'citrix':1A 'cve':12A,15A 'denial':9A 'enabl':8A 'fips':31A 'fips/ndcpp':35A 'gateway':21A,26A 'kba':6A 'memori':3A 'netscal':2A 'netscaler':18A,20A,22A,25A,28A,32A 'overflow':4A 'servic':11A","search_b":"'-121':55B '8.7':77B 'action':103B,109B 'appli':95B 'applianc':99B 'authent':36B,62B,80B 'av':85B 'avail':92B 'base':51B,61B 'behavior':67B 'buffer':52B 'bulletin':112B 'caus':65B 'citrix':37B,72B 'configur':110B 'cvss':75B 'cwe':54B 'denial':39B,69B 'denial-of-servic':38B 'email':108B 'exploit':116B 'gateway':42B 'host':47B 'impact':89B 'infrastructur':43B 'interact':83B 'kba':63B 'kbattribut':105B 'knowledg':60B 'knowledge-bas':59B 'ldap':102B 'n':87B 'n/pr':86B 'need':84B 'netscal':44B,57B 'overflow':53B 'rate':73B 'report':115B 'score':90B 'self':46B 'self-host':45B 'servic':41B,71B 'stack':50B 'stack-bas':49B 'unpredict':66B 'user':82B 'v4':76B","search_c":"'adc':139C 'authent':124C 'base':123C 'behavior':131C 'citrix':137C,141C 'denial':133C 'erron':130C 'gateway':143C 'kba':120C 'knowledg':122C 'knowledge-bas':121C 'lead':126C 'memori':117C 'netscal':138C,142C 'overflow':118C 'servic':135C 'unpredict':128C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T04:17:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111340","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111340","severity":null,"published_at":"2026-11-13T04:17:36+00:00","modified_at":"2026-11-13T04:17:36+00:00","first_seen_at":"2026-11-13T04:42:39+00:00","fetched_at":"2026-11-13T04:42:39+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111340:3820","url":"https://support.citrix.com/external/article/CTX697305","severity":null,"published_at":"2026-11-13T04:45:16+00:00","modified_at":"2026-11-13T04:45:16+00:00","first_seen_at":"2026-11-13T04:45:16+00:00","fetched_at":"2026-11-13T04:45:16+00:00","note":"Read Citrix bulletin CTX697305: preconditions, affected/fixed builds, no mitigations. Exploitation not stated. X not checked.","cites":["https://support.citrix.com/external/article/CTX697305"]}],"documents":[{"id":142058,"url":"https://support.citrix.com/external/article/CTX697305","title":"Citrix NetScaler ADC and Gateway Security Bulletin CTX697305","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}