NETSCALER ADC · CVE-2026-111342 · Infrastructure
FIX → 14.1-73.57 · 13.1-64.39 · 14.1-73.58 · 13.1-37.293 ✓ verified
Citrix bulletin CTX697305 (12 Nov 2026) lists a CWE-120 buffer copy overflow in LDAP authentication that can cause erroneous behavior or denial of service. CVSS v4 8.7, network vector, no privileges or user interaction required in the vector; impact rated availability only. Bulletin does not mention exploitation or a PoC, and says nothing about code execution.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-managed NetScaler ADC and NetScaler Gateway appliances set up as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server, on builds before the fixed ones. Appliances with no vpn or authentication vserver are outside the stated precondition. Citrix's vector lists no privileges required, so treat internet-facing gateways as reachable before login.
Not affected if no-gateway-or-aaa-vserver, patched-build
Who cares citrix, denial-of-service, ldap, netscaler, netscaler-gateway, self-hosted
Memory overflow in LDAP authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
add vpn vserver .* or add authentication vserver .* (Citrix's own check)Upgrade to 14.1-73.57 · 13.1-64.39 · 14.1-73.58 · 13.1-37.293